Task Manager problems, Pop Ups, Trojan, Virtumonde, my computer sucks

[xanimefanx]

Task Manager problems, Pop Ups, Trojan, Virtumonde, only says log off on start not shut down or anything. my computer sucks. popups like cannot find server and things wanting through my computer i need help

 

[howard_hopkinso]

Your system is infected with a variety of malware.

Also, all items in your AVG Antispyware log say "Ignored". That`s because you haven`t told AVG Antispyware to quarantine it`s results as per the instructions. See this pictorial guide.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results of the AVG Antirootkit scan.

Regards Howard

This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[xanimefanx]

Thank god my Task Manager shows up and the missing buttons for Turn off Computer shows up and Intel graphics media accelarator driver shows up in the corner by the clock ok so regedit is now showing up but i have problems

Mwinqndt.exe keeps wanted access granted in and out of my comp and if i open internet explorer and try to connect to different place mwinqndt.exe wants access and if i press deny it doesnt load the page. but firefox works and thats what im using right now but still that means theres a problem and i need it fixed
i have 2 weird things installed
Think-adz search assistant removal
Enhanced abs by think-ads removal
something like smitfraud toolbar would not delete in spybot s&d
and is something called axbxceft.dll supposed to be installed in internet explorer add-ons as a browser helper object?

 

[howard_hopkinso]

Once you`ve completed the instructions and posted the requested logfiles, I`ll be able to help you further.

Regards Howard

This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[xanimefanx]

Heres the logs from AVG Spyware, Analyze.exe, and combofix.exe.
Just to let you know i have 2 Quarantined files in AVG Anti-Spyware 7.5 from earlier that i did not delete because the last time i deleted them they came back the next time i scanned they are
Adaware.NewDotNet, Medium Risk
Trojan.Agent, High Risk
they both are in the system volume information as file's called A0005864.exe and A0005863.exe

i will not delete them without help from you.
Also the AVG Rootkit scan didnt find anything.

 

[howard_hopkinso]

Don`t worry about the system volume information at the moment, we`ll deal with that once your system is clean.


2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as fresh HJT and Combofix logs.

Regards Howard

This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[xanimefanx]

I posted them in the attachments

 

[howard_hopkinso]

Your log file look fine.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of xanimefanx only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[xanimefanx]

Trojan.Agent.anr how do i get rid of it

Trojan.Agent.anr has been found by AVG Anti-Spyware 7.5 and i have quarantined it.

 

[momok]

Hi,

Have HijackThis fix the following entries.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Apart from that, you log is clean. The file in question was quarantined by AVG Antispyware and its previous location was in the the C:\Avenger backup. Your system should be clean of infections.

Delete all files in the AVG Antispyware quarantine folder, and you're good to go.

Should you face any further problems, please post in this thread.


Regards,
Your friendly momok =)

This thread is for the use of xanimefanx only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[howard_hopkinso]

Threads merged.