Windows Firewall warning messages and explorer restarts

Welcome to Major Geeks!

The READ ME does not ask you to remove your restore points until all malware has been verified to have been removed. This was a bad idea since using System Restore may have been an easy/only way to recover from your problem if we do not see any malware reasons for them. But let's see what we can find and go from there.

Why are you approving all the malware to have access thru your firewall? I see a load of things in the list of aproved applications for your firewall. You should go thru your list of approved items and remove any that you do not recognize. Here are a few that I quickly notice:

Uninstall the below old versions of software:
Java(TM) 6 Update 3

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O11 - Options group: [java_sun] Java (Sun)

After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

One of the worst things you can do (besides malware) to your PC is to install multiple antivirus programs. We even stated right at the beginning of the READ ME that you must not do this. You have to uninstall all but one antivirus program name. I quickly noticed Avast and Avira. Pick one and only one and uninstall ALL others immediately!! It appears that you recently have installed quite a few which is not a good thing to do. It most likely has clutted up your registry with thousands of left over registry entries from all of these programs.

You still need to cleanup your Allowed Applications List in your Windows Firewall. I still see all of those entries. In fact I will give you a registry patch down below to try and remove everything from the approved list and we are going to install a better firewall since the Windows Firewall still leaves much to be desired.

You also added more things to the list that do not need approval as they do not try to access the network. I see the below:
"C:\\cf\\psexec.cfexe"= C:\cf\psexec.cfexe:*:Enabled:ipsec
"C:\\MGTools\\grep.exe"= C:\MGTools\grep.exe:*:Enabled:ipsec
"C:\\MGtools\\zip.exe"= C:\MGtools\zip.exe:*:Enabled:ipsec
"C:\\MGTools\\swwhoami.exe"= C:\MGTools\swwhoami.exe:*:Enabled:ipsec


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Now install a real firewall: Comodo Personal Firewall

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay I will give you a different fix below.

It could be normal activity. Without seeing exact details I cannot say. even what you mentioned about bla.exe is incomplete and does not give full or correct information. I don't think you have a folder named C:\Data

It is your choice on what you with to do. You must be very careful not to back and restore any infected files which is not easy to do if you don't know what is infected. One approach would be to not backup anything that could be considered an excuteable file. You do have a bunch of problems! Some may be malware but some are not. Some are due to what you have done by installing multiple antivirus applications. Even now, the antivirus programs that you do have installed are not running properly and my fix below will correct this.

Begin by uninstalling avast! Antivirus which appears to be broken.


Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [runspysweeperscheduleatstartup] "C:\Windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{8CA40A34-EE34-4E7A-8B87-A7206F483208}

After clicking Fix, exit HJT.


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now download and install this: AVG Free Edition Make sure you check for updates and then run a Full Scan on your PC.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're welcome. You should check out the below now:


How to Protect yourself from malware!