Usually there will be have Some similarly in Combo Fix Log or HijackThis Log ,just like this
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\mrofinu1188.exe
C:\WINDOWS\Fonts\svchost.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\b148.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b128.exe
This malware is most likely downloaded many other adwares and spywares to a user’s PC without one’s knowledge.
the running process:
C:\WINDOWS\mrofinu1188.exe
the startup item :
HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257
some links about removal mrofinu1188.exe:
http://forums.techguy.org/malware-removal-hijackthis-logs/652411-solved-winable-popups-limewire-gone.html
http://www.castlecops.com/t206741-malware_and_spyware_Dont_know_how_to_remove_Help.html
if you can not get rid of it by yourself ,you can try to go:
http://www.geekstogo.com/forum/Malware-Removal-HijackThis-Logs-Go-Here-f37.html
It is difficult to removal mrofinu1188.exe because it has downloaded lots fo other harmful malware.
How to remove?
download SREng:
http://www.kztechs.com/sreng/sreng2.zip
Extract it to the Desktop
Double click SREng.exe to run it
Select: Smart Scan
Then, click the [Scan] buttonWhen finished, click on the [Save Reports] button
Save the log to the Desktop,and send me a email with the log as Attachment.mailto:egomoo#gmail.com
I would be glad to help you to removal this Trojan.
