Need Help to Remove TRZ TMP

Hello guys…
As i read here: http://forum.avast.com/index.php?topic=127169.0
the solution is only for spesific user and not a general solution,
so, i attached the files as required.

please help…

thanks

attach Malwarebytes / OTL / aswMBR logs. http://forum.avast.com/index.php?topic=53253.0

I’m on it …
Reporting as soon as examine the logs

@ emannpmmc
Follow this instructions …

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

AutoClean;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log

===== Next =====

Re-run DDS tool and post me fresh DDS.txt and Attach.txt logreprot created by DDS.

wow…
i was thinking which one to follow…
i choose one only…

will proceed…

follow magna … if he need the logs in my post he will tell you.

The difference between DDS and OTL is a big and yet again so similar … :slight_smile:

For instance, DDS and OTL are generic tools and bouth shows the same loading point but both of them does with a difference.

While in case of some hardcore malware, DDS shall in most cases just show some information (known to helper) that will tell us that something (and what) big & maliciously is running on masine. OTL unlike DDS has a fix possibility and as such needs to display more detailed information. OTL shall show more malware details than DDS, and if it has enough power OTL can kill malware.

Briefly, DDS is initial tool that can tell us in short lines what is running on mashine and helps us to decide witch next tools to use for malware removal.
OTL is tool that doesn not need additional tool for fix and therefore it shall try to show all what DDS usual sees but in details.

:slight_smile:

attached

Re-run zoek as you did before but this time use this script:

emptyclsid;
emptyfolderscheck;delete 
{02478D38-C3F9-4efb-9B51-7695ECA05670};c
{483830EE-A4CD-4b71-B0A3-3D82E62A6909};c
ffdefaults;
addon@defaulttab.com.xpi;ff
c:\users\admin\appdata\roaming\mozilla\firefox\profiles\ul2fz042.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1};f
c:\users\admin\appdata\roaming\idm\idmmzcc5;f
c:\windows\system32\apl003.sys;f
c:\windows\system32\apf003.sys;f
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions];r
"mozilla_cc@internetdownloadmanager.com"=-;r
chrdefaults;
kiplfnciaokpcennlkldkdaeaaomamof;chr
C:\Users\Admin\AppData\Local\Torch;fs
emptyalltemp;

Whait while zoek finish his work (it shall ask you to reboot computer, allow that) and post me fresh zoek logs.

===== Next =====

Please download GMER, the RootKit Detector tool from the link below and save it to your Desktop:

Gmer download link
Note: file will be random named

Double-clicking to run GMER.

[*]Wait for initial scan to finish - if there is any query, click No;
[*]Click [ Scan ] button and wait until the full scan is complete;
[*]Click [ Save … ]- save the report to the Desktop (named ARK );

[*]Then click the >>> button and select Autostart card;
[*]Click [ Scan ] button;
[*] After quick scan, click Copy button;
[*]Open notepad and Paste text. Save report to the Desktop (named autostart )

Attach here both Gmer logreports. (ARK.txt and autostart.txt)

sorry guys,
my power blackout, took me a while to get to electrician.
i just finish zoek, while waiting for gmer scaning.

here is ARK.txt and autostart.txt
my pc getting worse with these uninvited files…

It does? It should be running much better after the latest zoek script.

Re-run zoek as you did before but use this script:

firefox@mega.co.nz.xpi;ff
autoclean;

Post me fresh created zoek log.

Now we shall use the big hammer as additional checks:

  1. Please download ComboFix by sUBs from here and save it to your Desktop.
    If you are unsure how ComboFix works please read this guide carefully.
    Note: ComboFix must be downloaded to your Desktop.

  1. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
    If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:

[*]Right click on the avast! system tray icon (
http://www.mcshield.net/pg/images/avast5.png
) in the lower right corner of the screen and scroll up to avast! shield controls;
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.


  1. Run ComboFix. Click on I Agree!

[i][size=7pt]- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.

  • ComboFix will check if there is a newer version of ComboFix available.
    Click Yes if prompted to download.[/size]
    -If Recovery Console is not installed, ComboFix will offer download & installation.
    Click Yes to allow ComboFix to install Recovery Console.
  • ComboFix will scan your computer in stages, total of 50 stages.
    Do not mouse-click around while ComboFix is running.
    Note:If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart your computer.
    [/i]

  1. When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
    Attach log reports ( ComboFix.txt) back to topic.

i dont know but hdd warning about data almost full always popup…
i’ll do the next step…

The message/pupup itself tells you what the problem is …

==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 498 GiB total, 306.975 GiB free.
D: is FIXED (NTFS) - 508 GiB total, 202.502 GiB free.
E: is FIXED (NTFS) - 1008 GiB total, 0.902 GiB free.
F: is FIXED (NTFS) - 1365 GiB total, 1002.927 GiB free.
H: is FIXED (NTFS) - 347 GiB total, 0.019 GiB free.
J: is CDROM ()

there is it.
actually, my hdd partition are free space about half of the entire space each.
but now it decrease time to time…
thats why i need help…

trz tmp files are still there.
almost every folder i can find them.
do i need to remove it manually? i think it will show up again

Logs doesn’t showing active malware.

Temp files ( .tmp ) are temporaly files or configuration files, inactive leftovers which may be used usually by some legit applications. Honestly, hardly any malware during configuration in hosts system does leave temp files behind.
You may remove the temp files if you wish so. I see from the picture that you set that folder as shared one to everyone.
In such situation you can not expect protection or security because if another computer on the local network is infected, the malware will be transferred or wait for user (wait for you) to trigger it.

We have establish where the problem is. The problem that you have is not malware related. Therefore I shall remove used tools:
You are malware free. Posted logs are now appear cleans and show no signs of active infection.

Good workman always cleans up after himself.

It is necessary to uninstall ComboFix :

[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.

On Windows7 or Vista you may use Start Search field if Run is not available.

[*] In the line of text type in (Copy) the following:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

[*] then click OK (or press Enter ).

Wait for the uninstall process is complete.

The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.


To help AntiVirus to protect your computer and speed it up, I recommend that you download, install and keep the following free programs:

  1. Keep Malwarebytes Anti-Malware, update it regularly or from time to time and run a Quick Scan weekly.
    Malwarebytes will detect and remove all traces of known malware. MBAM isn’t AntiVirus and it can NOT replace it.

  2. Keep MCShield Anti-Malware, the tool will be updated regularly and perform auto-checking for malware to each attached USB memory device.
    MCShield, has been designed as a lightweight scanner that’s smart enough to catch even new worms and work in fully automatic removal mode.

  3. It’s recommended to delete Temporary Files every once in a while. Run the tool and click on the Start button and TFC will begin to clean. Then restart the computer.
    Temp File Cleaner aka TFC by OldTimer
    TFC is small & usefull utility that shall clean up temp files from all userprofiles and system folders.


How to protect yourself?

  1. Adjust avast! to target PUP software:
    Run avast! 2014 by clicking the system tray icon in the lower right corner of the screen.
    Click on Settings, in the new window that opens, click on Active Protection, then under File System Shield click on gear wheel…
    Under Sensitivity part of option check box for Scan for potentialy unwanted programs PUP.

  2. avast! Software Updater. Run avast!, click on Tools > Software Updater.
    For security reasons, make sure you do update your browser(s), Java, Flash Player, and basically every software you use often.

  3. avast! Browser Cleanup. Run avast!, click on Tools > BrowserCleanup.
    Browser Cleanup tool is an integrated tool in avast! AV that allows you the control on browsers unwanted addons.

  4. avast! Malware Scan. Run avast!, click on Scan and preform QuickScan by clicking on Start button.
    Every once in a whilere, it’s recommended to preform virus scan with avast! 2014.