I have been having an issue the past week or so. I have multiple misc .exe's *32 running in my task manager that slow and lag the computer. They seemed to be started by a dllhost32. Then powershell stops working. Also I am unable to open any .exe programs that have to deal with removing malware or virus protection besides Immunet 3 and ADW Cleaner. Please advise where to go from here and what logs I should get.
Multiple .exe files running *32, powershell.exe crashes, unable to open malware protecction .exe's
- Thread starter jwolf199
- Start date
- Mar 8, 2013
- 22,627
Hello,
Please follow our Preparation Guide:
http://malwaretips.com/threads/preparation-guide-before-requesting-malware-removal-help.20334/
Please follow our Preparation Guide:
http://malwaretips.com/threads/preparation-guide-before-requesting-malware-removal-help.20334/
- Mar 8, 2013
- 22,627
Download attached fixlist.txt file and save it to the Desktop:
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!
- Right-click on
icon and select
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File). - Press the Fix button just once and wait.
- If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
- When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
- Right-click on
icon and select
Run as Administrator to start the tool.
- Accept the disclaimer and agree if prompted to install Recovery Console.
- Do not take any actions while ComboFix goes through your System - it may cause it to stall!
- This scan may take some time!
- When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
Include that log in your next reply.
Please download TDSSKiller by Kaspersky and save it to your desktop.
- Right-click on
icon and select
Run as Administrator to start the tool.
- Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
- Your machine may appear very slow and unusable after that - it's normal.
- TDSSKiller will run automaticaly. Click on Change parameters and click OK.
- Click the Start Scan button and wait patiently.
If anything will be found follow this guidelines:
- If a suspicious object is detected, the default action will be Skip, click on Continue.
- If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
If Cure is not available, please choose Skip instead. - Do not choose Delete unless instructed!
A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.
I can not get TDSS Killer to run. Here are my other logs. Everything seems to be working better besides TDSS Not working.
- Mar 8, 2013
- 22,627
Let's use other tool:
Download
Malwarebytes Anti-Rootkit to your desktop.
Download
- Double-click the icon to start the tool.
- It will ask you where to extract it, then it will start.
- Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
- Click in the introduction screen "next" to continue.
- Click in the following screen "Update" to obtain the latest malware definitions.
- Once the update is complete select "Next" and click "Scan".
- When the scan is finished and no malware has been found select "Exit".
- If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
- Open the MBAR folder and paste the content of the following files in your next reply:
- "mbar-log-{date} (xx-xx-xx).txt"
- "system-log.txt"
- Mar 8, 2013
- 22,627
Sorry for the late response. I was on vacation. I have the administrator rights pop up asking for permission then nothing happens after that. It also seems that while I was away I was attacked by the Cryptowall 3.0... that would be amazing if you could help as that isz starting to get to personal files and removable hardware.
- Mar 8, 2013
- 22,627
Download attached fixlist.txt file and save it to the Desktop:
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!
- Right-click on
icon and select
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File). - Press the Fix button just once and wait.
- If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
- When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.
- Mar 8, 2013
- 22,627
Seems fine. I am still unable to open some apps. Also I know my pictures are encrypted from the cryptowall 3.0 and I dont think there is anything you can do about it right. (no system restore available)
- Mar 8, 2013
- 22,627
Similar threads
