Help Urgently Needed

TiberX said:

Thank you for your comments and advice.

I ran flush.bat and sfc/scannow, both of which seemed to improve matters considerably until I re-booted.

As with the running of SuperAntiSpyware - now uninstalled - once those particular processes were completed and I re-started my laptop it went back to it's sluggish mode.

The Trojans were listed as Trojan.Unclassified-Packed/Suspicious. There were sixteen of them and they were, supposedly, quarantined and deleted.

I am still unable to download MalwareBytes' program and IE8 remains elusive.

Microsoft Security Essentials has been up and running on my computer since Windows 7 was installed last October. Lot of bloody good it did! The other programs were only downloaded on Friday to see if they might improve matters.

At the moment, it seems that my computer is responding better than it has been but everything is still really slow and there are no entries at all in MSCONFIG > Start-Up.

Perhaps I will just re-install Windows 7.

It's the Alureon rootkit from the sounds of it. Repeat the step the other posters mentioned and then download malwarebytes from here: http://dl.dropbox.com/u/561353/mbam-setup-1.46.exe

You can't get malwarebytes from it's distribution location due to Alureon. This URL is not blocked. Run it and let it scan!

baarod said:

I know can someone find out why we cant rep now?

If you have recently someone you have to rep 15 other people before you can rep that person again.

TiberX said:

Thanks baarod.

I downloaded via that URL but kept getting messages telling me errors had occured.

1) MBAM_ERROR_EXPANDING_VARIABLES(0,9)

2) same as 1

3) MBAM_ERROR_LOAD_DATABASE(3,0) The system cannot find the path specified

4) same as 1

5) MBAM_ERROR_MISSING_FILE (3,0 mbamswissarmy.sys) The system cannot find the path specified

I then ran the downloaded program but got message 1 again, followed by a repeat of message 5. The screen then went blank.

The program is listed in PROGRAM FILES.

This is an infected registry. Variable expansion is used for taking literals like %desktop% and expanding them to system paths. You definitely have a rootkit.

What is the system file that was identified?

Jacee said:

What is the system file that was identified?

mbamswissarmy.sys, part of malwarebytes

MacGyvr said:

Go to Bleeping Computer - Computer Help and Discussion, download and run ComboFix. If you can't download it, you will need to have your computer professionally cleaned or reinstall Windows.

Also, in defense of MSE, no antivirus will prevent all infections. I clean 5-6 computer per week, all with various antivirus software, all claiming to be running, all claiming the computers are clean. 98% safe is the best you can plan to be.

Spot on. Good post.