unknown malware affecting Explorer, mail, computer speed

Discussion in 'Malware Help (A Specialist Will Reply)' started by ecatonvx, Sep 23, 2008.

  1. ecatonvx

    ecatonvx Private E-2

    I have been having problems with my laptop (2 MG RAM - running Vista) for months now and have done a number of rebuilds from the internal recovery disk and from manufacturer-supplied system disks but it keeps getting reinfected. I suspect it is from my web-based email or USB drives. The last post-rebuild infection occurred after visiting a few sites (including my email) and using the USB drive to charge a new MP3 device.

    Whatever it is was able to outmanouver Norton so I switched to BitDefender but that hasn't helped. The computer is very slow when I am viewing images such as jpgs, the key input will stop working or the screen image will move when I am inputting passwords, and Explorer crashes when I close a tab. In gmail, when I log out I get a message that I have been logged out and that this may be because someone else has logged in from the same browser.

    I have run the Vista cleaning procedure and the log files for Malwarebytes, and combofix and mgtools are attached. I couldn't find a log for the Spybot or SuperAntiSpyware but they ran and gave messages that nothing was found.

    Additionally, I now have a c:\QooBox directory that I believe contains quarantined files.

    I would like some help finding out what is on my computer, how to get rid of it, and most importantly how to protect myself from it in the future.

    Thanks in advance for any help,

    ecatonvx
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Why did you run Malwarebytes and not have it fix anything?

    Please run it again and have it fix everything it finds. Then run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from MWB's.
     
  3. ecatonvx

    ecatonvx Private E-2

    First of 2 posts - (2 of 5 attachments)

    Tim W,
    Thank-you for your reply,

    I must have attached the wrong Malwarebytes log - I ran it with the remove option as well (mbam-log-2008-09-22(17-14-36) copy.txt)

    I still went through the steps you suggested in your reply - I ran Malwarebytes (mbam-log-09-25 (11-33-51) copy.txt and ran mgtools (now renamed MGlogs 25 09 08 am.zip). After running these I couldn't find any log files for Malwarebytes so I opened the application and did a save as from the logs tab.

    I then thought that whatever is causing the problem may have affected the Malwarebytes so I did a fresh download and reran it and MGlogs (mbam-log-2008-09-25 (12-43-21) copy.txt and MGlogs.zip). These logs are the latest and are attached to this post - I'll post the earlier logs in a following post in case you need to see them.

    If you need me to run anything else please let me know.

    Thanks,

    ecatonvx
     

    Attached Files:

  4. ecatonvx

    ecatonvx Private E-2

    Second of 2 posts - (3 of 5 attachments)

    This post contains attachments that my previous post refers to.
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The only thing I see in your logs are that you need to update your Java....other than that, what issues are you still having?
     
  6. ecatonvx

    ecatonvx Private E-2

    TimW,

    Thanks for your response.

    I'm still getting the message from my email server that I mentioned before and when I close one tab in Explorer the whole program shuts down.

    Other than web-based email and Explorer I haven't been using the machine to run any applications until the problems are cleared up.

    When I was downloading Malwarebytes I was getting messages "you are entering a secure site click to continue" then without clicking "you are leaving a secure site click to continue" then without clicking "Explorer has blocked a download". I eventually got the software downloaded from a different link on the site.

    I don't think that Malwarebytes is deleting the infected files on reboot. There are 82 listed and they show up on each log.

    The directories listed as containing infected files are inaccessible. I get a message of access denied when I try to open them, even as Administrator.

    If you need more scans or more information just let me know.

    Thanks,

    ecatonvx
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to run the scans (SAS and MWB's) as well as MGTools on the default user account and attach those logs.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds