What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

3 different trojans and PING.exe process using 100% CPU

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
here's the new log :) aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-11 03:21:20 —————————– 03:21:20.936 OS Version: Windows x64 6.1.7601 Service Pack 1 03:21:20.936 Number of processors: 1 586 0x603 03:21:20.936 ComputerName: ESY-PC UserName: Esy 03:21:31.061 Initialize success 03:26:55.656 AVAST engine defs: 11091100 03:28:22.689 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 03:28:22.689 Disk 0 Vendor: Hitachi_HTS545025B9A300 PB2OC60F Size: 238475MB BusType: 11 03:28:22.689 Device \Driver\atapi -> MajorFunction fffffa80031106c0 03:28:24.732 Disk 0 MBR read successfully 03:28:24.732 Disk 0 MBR scan 03:28:24.748 Disk 0 MBR:Alureon-G [Rtk] 03:28:24.748 Disk 0 TDL4@MBR code has been found 03:28:24.764 Disk 0 MBR hidden 03:28:24.764 Disk 0 MBR [TDL4] **ROOTKIT** 03:28:24.764 Disk 0 trace - called modules: 03:28:24.764 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa80031106c0]<< 03:28:24.779 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80030a61f0] 03:28:24.779 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800306d060] 03:28:25.294 \Driver\atapi[0xfffffa8003087160] -> IRP_MJ_CREATE -> 0xfffffa80031106c0 03:28:26.027 AVAST engine scan C:\Windows 03:28:29.147 AVAST engine scan C:\Windows\system32 03:31:06.427 AVAST engine scan C:\Windows\system32\drivers 03:31:18.798 AVAST engine scan C:\Users\Esy 03:33:14.698 AVAST engine scan C:\ProgramData 03:33:53.183 Scan finished successfully 03:35:51.698 Disk 0 MBR has been saved successfully to "C:\Users\Esy\Desktop\MBR.dat" 03:35:51.707 The log file has been saved successfully to "C:\Users\Esy\Desktop\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-13 12:34:49 —————————– 12:34:49.279 OS Version: Windows x64 6.1.7601 Service Pack 1 12:34:49.279 Number of processors: 1 586 0x603 12:34:49.279 ComputerName: ESY-PC UserName: Esy 12:34:50.105 Initialize success 12:34:54.723 AVAST engine defs: 11091301 12:35:51.196 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 12:35:51.196 Disk 0 Vendor: Hitachi_HTS545025B9A300 PB2OC60F Size: 238475MB BusType: 11 12:35:53.271 Disk 0 MBR read successfully 12:35:53.271 Disk 0 MBR scan 12:35:53.287 Disk 0 unknown MBR code 12:35:53.287 Service scanning 12:35:54.316 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 12:35:55.112 Modules scanning 12:35:55.112 Disk 0 trace - called modules: 12:35:55.143 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 12:35:55.143 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80030b6060] 12:35:55.159 3 CLASSPNP.SYS[fffff880019ba43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8003064060] 12:35:55.970 AVAST engine scan C:\Windows 12:36:07.966 AVAST engine scan C:\Windows\system32 12:38:44.154 AVAST engine scan C:\Windows\system32\drivers 12:38:55.932 AVAST engine scan C:\Users\Esy 12:43:19.198 AVAST engine scan C:\ProgramData 12:43:59.571 Scan finished successfully 12:54:40.856 Disk 0 MBR has been saved successfully to "C:\Users\Esy\Desktop\MBR.dat" 12:54:40.872 The log file has been saved successfully to "C:\Users\Esy\Desktop\aswMBR.txt"
Post #20
Yes get all the windows updates now.


You appear clean of infections,please do the following.Delete TDSSKiller,aswMBR,ESET and any logs you have.



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)









Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.











Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean











[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 7 and save it to your desktop.
  • Scroll down to where it says JDK 7 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.











Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing
Post #21
Thank you so much, the computer seems to be running great! ping.exe is not running at 1,000,000K anymore or even showing up and the windows updates ran smoothly. I loooooove the feeling of a clean computer! I was a little nervous about that java7, i scrolled and saw Java SE 7 and then beside it jdk7 and jre 7 (i clicked on that one) but there was no offline version for windows 64 and the terms and agreement was different from what you wrote. the name of the file i downloaded from your link was jre-7-windows-x64, it seemed to install alright and it shows in the control panel as java tm 7 or something. also, is it ok to delete TFC? and the file i used to download java? (sorry if i sound like a rookie) and thank you again!!! you saved our computer :yeah:
Post #22
i tried to check for software updates online with one of the programs you listed and it said my java might not be working so i went to the oracle/sun site to see what java i had running and it couldn't detect, prompting Firefox to pop up it's plugin console with a java download so i downloaded it and then the site said im running java 6 update 26 :\
Post #23 last edited

is it ok to delete TFC? and the file i used to download java?

I would keep TFC and use it weekly unless you have another temp file cleaner,you can delete the java file.

Maybe Java 7 is not compatible with Firefox yet but you will be alright with what you have now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI