Multiple Infections - Trojans / Worms

[jordanjm2]

My kid's computer seems to have multiple infections.

Ran SpyBot, Malwarebytes and EST Online Scanner. Having redirect issues in both IE and Firefox, ping.exe is consuming system resources, DealFly loaded in both browsers (now disabled), multiple outbounds stopped (146.185.250.210, 83.133.120.186 and others).

EST reported :

C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftdu0r91.default\extensions\{2245711c-aa1d-4627-98c2-6efdf8c0b707}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ToolbarFacemood88.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined

C:\Documents and Settings\Sherrie\Application Data\Mozilla\Firefox\Profiles\013fzdhm.default\extensions\{2245711c-aa1d-4627-98c2-6efdf8c0b707}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined

C:\Documents and Settings\Sherrie\My Documents\Downloads\Facemoods.exe a variant of Win32/SweetIM.B application cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114606.sys a variant of Win32/Olmarik.AWT trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114629.sys a variant of Win32/Olmarik.AWT trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114642.sys a variant of Win32/Olmarik.AWT trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114664.sys a variant of Win32/Olmarik.AWT trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114677.sys a variant of Win32/Olmarik.AWT trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114688.sys a variant of Win32/Olmarik.AWT trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114701.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1988\A0114710.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\redbook.sys a variant of Win32/Olmarik.AWT trojan unable to clean

Operating memory multiple threats

Need help in cleaning this mess up!

Thanks! Jim

dds.txt

attach.txt

[screen317]

Hi and welcome to Malwarebytes.

In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly in your reply.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!