Hello,
I am having serious issues cleaning a computer that has constant connection attempts to 188.165.198.52. I have run about every scanner I can think of and nothing is detecting it. (MBAM, Adwcleaner, rkill, sophos, Avast, JRT, Combofix. I am working on attaching logs but the computer has become relatively unresponsive overall. Currently It boots to desktop but gets stuck when trying to connect to the internet (i have it unplugged). Seems to behave for a bit if i plug it in but tries to connect constantly. Thanks!
Logs Attached - Could not get a malwarebytes log; when in safe mode (the only thing working) the export option is out of window frame and can not be brought into frame nor resized. Any help will be greatly appreciated as I have been fighting with this for about 36 hours. Thanks!
Could you let me know what problems you are experiencing after this run please
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
FF Extension: No Name - C:\Users\JZara\AppData\Roaming\Mozilla\Firefox\Profiles\wj50roo4.default\extensions\008abed2-b43a-46c9-9a5b-a771c87b82da@1ad61d53-2bdc-4484-a26b-b888ecae1906.com [Not Found]
2014-10-22 11:24 - 2014-10-22 11:25 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-10-21 12:38 - 2014-10-25 16:49 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
Hello,
I have ran the fix and it seemed to work better for an hour or so, now the computer is almost unresponsive on the times that it actually logs in. Right now it is not even logging in and just sitting with the Welcome screen and a spinning circle. I’ll get logs in as soon as I can. I’m working from another computer so I may pull the drive and pull the files over that way just to get the log files. This is the worst infection I’ve ever seen.
EDIT: One thing I did notice is that the connect stopped popping up in Avast but I have been haven’t significant trouble getting back into the computer since.
EDIT2: Attaching Log Files, Also in process of running combofix which I noticed that avast started going bonkers blocking various files located in Program Files (x86).
Log Files Attached
Fix Log and New FRST log - seems like I just pissed it off more than anything
Edit: After much fighting and shenanigans I was able to get aswMBR to run. Once it completes Log will be attached.
Could you uninstall trend micro please then run the download tool which can be found under this heading Having problems removing Trend Micro? here http://esupport.trendmicro.com/pages/how-do-i-remove-old-or-new-versions-of-trend-micro-products-in-my-comp.aspx