Computer resources maxed all of a sudden

[IslandPoker]

Good day, so for the most part I generally only use Chrome for surfing. I also have been known to use uTorrent on occasion. A couple days ago after dinner I noticed my computer had crashed and after rebooting it was slow and sluggish. I did a virus scan but nothing, then installed and ran MBAM, also came back clean. I had noticed a couple new files and folders in my Users/AppData/Roaming and LocalLow folders which looked suspicious one folder that I can remember was called "furydeh", the file in it was "fygiuxi.exe". After opening task manager I had noticed a couple of fygiuxi.exe processes running, after force stopping they would almost imediately start up again. After playing around in safe mode for a bit I managed to eliminate these folders/files. However, now I am getting MBAM website blocked popups. The domain name varies but the ip is always the same 46.161.41.220  I also now have multiple instances of iexplore.exe processes running though IE is not "running" and I never use it. Just hoping someone can help me or guide me in the right direction to some self help.

 

Thanks a bunch!

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[IslandPoker]

Thank you very much for offering to help. Here are the two logs requested.

Addition.txt

FRST.txt

[TwinHeadedEagle]

We will need to run more steps to clean this infection:
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 

Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
• Include that log in your next reply.
  If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
  If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

fixlist.txt

[IslandPoker]

Once again, thank you for your help. Here are your requested logs

Fixlog.txt

ComboFixLog.txt

[TwinHeadedEagle]

Very good, how is your PC now?

[IslandPoker]

Still shows iexplore.exe running in background and getting the MWAB pop up when I start to surf anything other than here.

[IslandPoker]

Update. Even when just sitting at this page the MBAM malicious website pop is appearing.

[IslandPoker]

Not sure if this will help but here is a new scan.

Addition.txt

FRST.txt

[IslandPoker]

I hope I am not being too much of a pain. I am siting here and have now noticed a NEW process that decides to run multiple times on its own. MBAM scan says everthing is normal. This process is qbsgwjxv.exe I have also taken a new scan so I do not know if these are different from my previous post or not as I did not previously notice this new process until about a half hour ago. I am going to assume they are different as the file sizes are different. These are the most recent scans.

 

 

FRST.txt

Addition.txt

[TwinHeadedEagle]

I see you have some poker software on your PC. I am pretty sure your problem comes from them:
- 888poker
- partypoker
- Poker PlayNow.com
- PokerStars
 
I would suggest you to uninstall them.
 
 
At the other side, I think I warned you in my first post about piracy. We do not support any piracy and MalwareBytes often blocks it, so this could be source of your problem too.
 
  

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[IslandPoker]

Here is the updated log. There are no longer any P2P software installed on this computer since starting this diagnosis as per requests.

Fixlog.txt

[TwinHeadedEagle]

How is your PC now?

[IslandPoker]

Still the iexplore (But only seems to be one instance at a time not multiple) running and the Malicious Website Blocked popup

[TwinHeadedEagle]

Okay, keep me updated.

[IslandPoker]

I presume the popup is nothing to be concerned about?

[TwinHeadedEagle]

Can you make a picture of that pop-up?

[IslandPoker]

Sorry for the delay, had to work. This is the only way I could figure our how to get you a shot of the pop up. I copied 2 screen shots into a wordpad doc. At the rate things are going I am pretty much at the point that I am thinking of just reformatting and reinstalling Windows

 

 

popup.rtf

[IslandPoker]

another shot

 

 

[TwinHeadedEagle]

Let's run one more fix:
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[IslandPoker]

Nothing, still popups.

Fixlog.txt

[IslandPoker]

Just got this.

[TwinHeadedEagle]

McAfee warning is false, ComboFix is tool we used.

 

Try to reset your internet explorer

 

http://support.microsoft.com/kb/923737

[IslandPoker]

That didn't help at all. I appreciate your attempt to assist me. However, I have concluded it will be easier to reinstall windows so that is what I am in the process of doing. Thank you again for trying.

[TwinHeadedEagle]

Thanks for letting me know