Abebot,Trojandownloader.XS,PC-Cleaner Spyware Help needed

[lesha]

Someone please help me! wml.exe keeps popping up too. This is my work computer and I am going to be in big trouble if I crash this lap top for the 2nd time in one month. I have read some in the forums. I have downloaded the HiJackThis.exe, the malwrebytes' anti-malware. I ran the hijack and have attached the file for review. Please let me know what I should do next if someone has a few minutes to spare. Thank you! Any help is greatly appreciated!

 

[kimsland]

There have been a number of these same posts lately,
I wonder if everyone is visiting the same site, it would be interesting to know.

As there are so many posts on this "wml.exe" you may want to search it here at TechSpot or even look further down the page (this page you're on right now) for similar faults as your heading.

The removal for them all seem to be similar.

 

[lesha]

I've researched this for a couple of days... and from what I am seeing, isn't the fix you apply based on the .txt files that you save from your own hard drive and post? Isn't everyone's fix going to be different?? Someone please let me know. Thanx

I will post the .txt file on here...I keep getting an error on the attachment?

Trying to paste txt in here but it says must have 5 post or greater

Sorry about this

(Moderator edit: Please do not copy and paste your logs. Instead, post them as attachments only in either .txt or .log format. To learn how to attach a log file, please see HERE.
Posts merged. Please use the edit button, rather than replying to your previous post where there are no other replies in between. If bumping the thread, please wait at least 24 hours for a reply.)

 

[kimsland]

lesha

isn't the fix you apply based on the .txt files that you save from your own hard drive and post?

Well yes and no !

You must ATTACH

the HijackThis Log, not paste it.

Multiple replies, to yourself, is against TechSpot's guidelines in creating a post.

Not only that, but referring to old threads, you would have seen what tools were used to try to remove this Trojan. Of which I was trying to get you to do, firstly.

Actually, before supplying any attachments you must run:
Viruses/Spyware/Malware, preliminary removal instructions
These steps were pinned to the top of the Security and the Web
And in most cases will remove all Virus/Trojans... so forth

I would also recommend to run CCleaner on your drive (removing all temp files)

Regarding posting the logs:

There is no need to post the logs if your system is clean from performing the above steps.

I am now going to try to remove all your multiple posts, this takes time!

Edit:
I have decided to search for you myself
Typing wml.exe in TechSpots Search yields over 100 posts.

Here is one of the helpful replies: https://www.techspot.com/vb/post603705-14.html

Please also try searching these, similar posts, for other tools (scanning tools) that were used

 

[lesha]

Referring to the old threads is exactly why I thought the "fix" came from the logs that are attached in the threads. Once they attached them, then someone reviewed their logs and gave them the next step to and so on. I downloaded the HijackThis and I tried to attach the .txt file but it kept giving an error message. I apologize for the mulitple posts, I am just trying to get some help here.

 

[kimsland]

No support person says reply to yourself 5 times and the attach the post.

Regarding the similarity, (ie my first post to you) there are a number of tools used even before HiJackThis attachment

 

[Blind Dragon]

In regards to the error for attachments. Click on the Edit profile button on the left of the blue bar above, go all the way down the left pane to attachments, remove any attachments you already have. Afterwards follow below.

Malwarebytes' Anti-Malware

• Please download Malwarebytes' Anti-Malware to your desktop.
  
• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Combofix

• Download Combofix to your desktop.
• Double click combofix.exe & follow the prompts.
• A window will open with a warning.
• When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log.

Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Combofix is a very powerful tool so please do NOT do anything without instruction

Combofix will automatically save the log file to C:\combofix.txt



Highjackthis Instructions

• Make sure you have the LATEST version of HJT (currently v2.0.0.2) it can be downloaded from HERE
• Run the HijackThis Installer and it will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe. Please don't change the directory.
• After installing, the program launches automatically, select Scan now and save a log
• After the scan is complete please attach your log onto the forums using the paper clip icon above your reply.

 

[Jeffrey]

TrojanDownloader problem as well.

Here are the files requested as in the other responses. I am experiencing the same problems as others. Any help would be greatly appreciated.

 

[Blind Dragon]

Jeffrey,

This thread is for the use of the original thread starter only. In order for us to help you, we need you to make your own thread here in our Security and the Web Section