Please help me fix my computer from randomly freezing.

[ShockTroop0351]

Hi, this is the log from the MBR:


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x012A18AC1
malicious code @ sector 0x012A18AC4 !
PE file found in sector at 0x012A18ADA !

THANKS!

[evilfantasy]

Now delete the current mbr.log file from the desktop and then follow the below instructions.

Go to Start > Run then copy and paste the following into the Open field (do not copy the word Code):

Code: [Select]

"%userprofile%\desktop\mbr.exe" -f
Double click on the mbr.exe file and post the contents of the new mbr.log

[ShockTroop0351]

Ok, here is the newest file

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x012A18AC1
malicious code @ sector 0x012A18AC4 !
PE file found in sector at 0x012A18ADA !

Thank you 

[evilfantasy]

OK go ahead with the full Dr Web scan now and post that log please.

You can delete the mbr.exe and the log file.

[ShockTroop0351]

Ok, heres my log after the full scan:

T-3877633-daddys little girl al martino - greatest hits.mp3;C:\Documents and Settings\Brad\My Documents\Incomplete;Trojan.WMALoader;Cured.;
WxBug.EXE;C:\Program Files\aim\Sysfiles;Adware.Aws;;
morpheustoolbar.exe/data001\data006;C:\Program Files\Morpheus\morpheustoolbar.exe/data001;Adware.Msearch;;
data001;C:\Program Files\Morpheus;Container contains infected objects;;
morpheustoolbar.exe;C:\Program Files\Morpheus;Container contains infected objects;;

Thanks again.

[evilfantasy]

OK that found a few more. How is the computer running now?

[ShockTroop0351]

As of yet I've had now problems. So far I've been up for about 24 hours. Thanks again for all your help.

[ShockTroop0351]

Still no problems, thank you very much for all your guys' help.

[evilfantasy]

Sorry for the delay.

Download OTMoveIt3 by OldTimer OTMoveIt3.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt3.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt3

----------

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide
.
----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.