Malware that won't allow other users to log on

[Janx]

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\program files\mozilla firefox\firefoxmgr.exe (Spyware.Passwords.XGen) -> Delete on reboot.

c:\program files\whbyjtlw\fnslttuk.exe (Spyware.Passwords.XGen) -> Delete on reboot.

c:\program files\packardbell\packard bell recovery management\erecovery\hidchkmgr.exe (Spyware.Passwords.XGen) -> Delete on reboot.

c:\program files\quicktime\qttaskmgr.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

I've had issues with new windows randomly opening in firefox and some users on this computer can't log in, they enter the password and it logs off and goes back to the start up screen. Please can someone help me, thank you.

[Janx]

P.S I forgot to add that I selected remove and deleted it but it won't go away

[screen317]

Hi and welcome to Malwarebytes.

I'm afraid I have bad news.

Your logs reveal an information stealing trojan.

I would counsel you to disconnect this PC from the Internet immediately, and only reconnect to download any tools that are required. If you do any banking or other financial transactions on the PC or it if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

You will need to change your passwords, and all other sensitive information, but only once your system is deemed clean.

With that said, please do the following.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[Janx]

Here is my log file, I don't have any info saved on the computer but it's the fact that other users can't log in that bothers me. Hope you can fix this.

Hi and welcome to Malwarebytes.

I'm afraid I have bad news.

Your logs reveal an information stealing trojan.

I would counsel you to disconnect this PC from the Internet immediately, and only reconnect to download any tools that are required. If you do any banking or other financial transactions on the PC or it if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

You will need to change your passwords, and all other sensitive information, but only once your system is deemed clean.

With that said, please do the following.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[Janx]

Forgot the file lol

DDS.txt

[screen317]

Hi,

I strongly suggest formatting the drive and starting over.

The disk would be clean and the logging in issue would also go away.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!