1 reply to this topic

[jamaster14]

I have been having an issue with my computer. I seem to have gotten a trojan. It disguises it self as iexplore.exe and services.exe. Internet explorer runs in the backround and plays audio of all kinds of ads. i can kill the process, but it just respawns. same with services.exe. It seems like the trojan got in through an exploit in wmp or iexplorer as i hadnt run those security updates in a while(doh!)

Anyhow, I tried running various adware/virus scans, but i am unable to. if i try and run malwarebytes,mcafee,norton,hijack this, avp, etc this trojan will stop the program from running, then make its directory read only prevent it from being run again. this also happens in safe mode.... I tried renaming the directories and executable files, but it didnt help any.

I tried the web base virus scans, but the computer froze whenever i did. i tried combing through the registry, but couldnt find anything of note.

I saw another thread hear with a file to check the master boot record. i ran it based on the instructions and here was the result:

C:\WINDOWS>mbr.exe -t
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
called modules: ntoskrnl.exe >>UNKNOWN [0x8A62AC92]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a6bab80
Warning: possible MBR rootkit infection !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

C:\WINDOWS>mbr .exe -f
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: MBR read successfully

i assume this is part of my problem, but not sure where to go from here. running the mbr.exe -f fix command didnt seem to do anything....

any help would be appreciated, id prefer not to reformat/re-install if can avoid it as i have a ton of software and subscriptions on here that i cant really back up

[prairie dog]

Hi and welcome to the forum!

Please read and follow ALL the instructions below. Thanks!


Scan and post logs - read note at bottom in green
If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here:Malware Removal - HijackThis Logs
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.


* Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
* Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
* Using these other tools often makes the cleanup task more difficult and time consuming.
* If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
* Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
* There are often many others that require assistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review


* NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can