Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Warning! Security report...


  • This topic is locked This topic is locked
4 replies to this topic

#1 amandam239

amandam239

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:38 PM

Posted 12 January 2009 - 08:25 PM

I was recently infected with a virus that has done several things...

My desktop says 'Warning Dangerous Spyware. May viruses were found on your computer'...etc.

'Warning! Security report. Your computer is infected! It is recommended to start spyware cleaner tool' balloon and red X in system tray

Malwarebytes was run several times and found nothing. I am unable to download ANY other anti-malware software or update the existing Malwarebytes program I already have installed.

If I try to uninstall any programs I get 'invalid floating point' error.

My Documents opens randomly for no reason.

If I click on any file or folder it takes me to some stupid supposed anti-malware page.

This is the DDS file:


DDS (Ver_09-01-07.01) - NTFSx86
Run by bryanda at 20:01:50.60 on Mon 01/12/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.230 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\userinit.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\ntdll64.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\ntdll64.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\bryanda\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
BHO: {1c1be401-d168-0498-6c04-72c08066b30c}: {c03b6608-0c27-40c6-8940-861d104eb1c1} - c:\windows\system32\sakpfb.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
mRun: [EPSON PictureMate] c:\windows\system32\spool\drivers\w32x86\3\E_S4I2P1.EXE /P17 "EPSON PictureMate" /O6 "USB001" /M "PictureMate"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_06\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Framework Windows] frmwrk32.exe
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: c:\windows\temp\ntdll64.dll
AppInit_DLLs: sakpfb.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\bryanda\applic~1\mozilla\firefox\profiles\nqqa2qww.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll
FF - HiddenExtension: XUL Cache: {43BFDD01-F705-47C0-8758-337CF2636C55} - c:\windows\system32\config\systemprofile\local settings\application data\{43bfdd01-f705-47c0-8758-337cf2636c55}\

============= SERVICES / DRIVERS ===============

R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-8-8 24652]

=============== Created Last 30 ================

2009-01-12 19:26 <DIR> --d----- c:\program files\Trend Micro
2009-01-12 19:03 <DIR> --d----- c:\program files\Lavasoft
2009-01-12 19:02 <DIR> --d----- c:\windows\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
2009-01-12 19:02 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-01-12 13:56 111,616 a------- c:\windows\system32\ntdll64.exe
2009-01-12 13:26 1,347 a------- c:\windows\system32\ahtn.htm
2009-01-12 13:26 4,785 a------- c:\windows\system32\warning.gif
2009-01-12 13:26 491 a------- c:\windows\system32\win32hlp.cnf
2009-01-12 13:25 111,616 ac------ c:\windows\system32\dllcache\userinit.exe
2009-01-12 13:25 1 a------- c:\windows\system32\uniq.tll
2009-01-12 13:25 1 a------- c:\windows\system32\test.ttt
2009-01-12 13:24 31,232 a------- c:\windows\system32\frmwrk32.exe
2009-01-12 13:24 31,232 a------- c:\windows\system32\pcload.exe
2009-01-12 03:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\vsosdk
2009-01-12 01:32 87,608 a------- c:\docume~1\bryanda\applic~1\inst.exe
2009-01-12 01:32 47,360 a------- c:\windows\system32\drivers\pcouffin.sys
2009-01-12 01:32 47,360 a------- c:\docume~1\bryanda\applic~1\pcouffin.sys
2009-01-12 01:32 217,127 a------- c:\windows\system32\drv43260.dll
2009-01-12 01:32 208,935 a------- c:\windows\system32\drv33260.dll
2009-01-12 01:32 176,165 a------- c:\windows\system32\drv23260.dll
2009-01-12 01:32 102,439 a------- c:\windows\system32\sipr3260.dll
2009-01-12 01:32 65,602 a------- c:\windows\system32\cook3260.dll
2009-01-12 01:32 1,184,984 a------- c:\windows\system32\wvc1dmod.dll
2009-01-12 01:32 626,688 a------- c:\windows\system32\vp7vfw.dll
2009-01-12 01:32 <DIR> --d----- c:\program files\VSO
2009-01-10 19:50 <DIR> --d----- c:\windows\system32\NtmsData
2009-01-07 11:50 73,216 a------- c:\windows\system32\ffkuz.dll
2009-01-07 00:32 <DIR> --d----- c:\windows\system32\LogFiles
2009-01-06 21:57 57,856 a------- c:\windows\system32\xxywWpqP.dll
2009-01-06 21:53 1,320,839 ---sh--- c:\windows\system32\jacfvneu.ini
2009-01-06 21:50 137,728 a------- c:\windows\system32\sakpfb.dll
2009-01-06 21:50 137,728 a------- c:\windows\system32\imnvqxbl.dll
2009-01-06 21:50 50,176 a------- c:\windows\system32\tuvTMgHB.dll
2009-01-06 21:24 <DIR> --d----- c:\program files\DNA
2009-01-06 21:24 <DIR> --d----- c:\docume~1\bryanda\applic~1\DNA
2009-01-06 18:57 <DIR> --d----- c:\docume~1\bryanda\applic~1\DVD Flick
2009-01-06 18:51 40,960 a------- c:\windows\system32\ssubtmr6.dll
2009-01-06 18:51 662,288 a------- c:\windows\system32\mscomct2.ocx
2009-01-06 18:51 609,824 a------- c:\windows\system32\comctl32.ocx
2009-01-06 18:51 212,240 a------- c:\windows\system32\richtx32.ocx
2009-01-06 18:51 164,144 a------- c:\windows\system32\comct232.ocx
2009-01-06 18:51 36,864 a------- c:\windows\system32\trayicon_handler.ocx
2009-01-06 18:51 28,672 a------- c:\windows\system32\mousewheel.ocx
2009-01-06 18:51 <DIR> --d----- c:\program files\DVD Flick
2009-01-06 18:21 21,504 ac------ c:\windows\system32\dllcache\hidserv.dll
2009-01-06 18:21 21,504 a------- c:\windows\system32\hidserv.dll
2009-01-06 18:21 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-01-06 18:21 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-01-06 18:21 9,600 ac------ c:\windows\system32\dllcache\hidusb.sys
2009-01-06 18:21 9,600 a------- c:\windows\system32\drivers\hidusb.sys
2009-01-01 19:48 <DIR> --d----- c:\docume~1\bryanda\applic~1\ZoomBrowser EX
2009-01-01 19:43 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ZoomBrowser
2009-01-01 19:41 <DIR> --d----- c:\program files\common files\Canon
2008-12-29 11:09 <DIR> --d----- c:\windows\system32\CatRoot_bak
2008-12-29 11:07 331,776 -c------ c:\windows\system32\dllcache\msadce.dll
2008-12-29 11:07 683,520 -c------ c:\windows\system32\dllcache\inetcomm.dll
2008-12-29 11:07 247,326 -c------ c:\windows\system32\dllcache\strmdll.dll
2008-12-28 16:41 <DIR> --d----- c:\program files\iTunes
2008-12-28 16:41 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-28 16:40 <DIR> --d----- c:\program files\Bonjour
2008-12-28 16:39 54,156 a---h--- c:\windows\QTFont.qfn
2008-12-28 16:39 1,409 a------- c:\windows\QTFont.for
2008-12-28 16:37 32,000 a------- c:\windows\system32\drivers\usbaapl.sys
2008-12-28 16:22 221,184 a------- c:\windows\system32\wmpns.dll
2008-12-28 16:17 <DIR> --d----- c:\windows\ServicePackFiles
2008-12-28 16:15 2,897,920 -------- c:\windows\system32\xpsp2res.dll
2008-12-28 16:13 19,528 a------- c:\windows\002370_.tmp
2008-12-28 16:13 <DIR> --d----- c:\windows\system32\ReinstallBackups
2008-12-28 16:09 <DIR> --d----- c:\windows\EHome
2008-12-28 16:00 <DIR> --d----- c:\docume~1\bryanda\applic~1\Uniblue
2008-12-16 18:40 <DIR> --d----- c:\program files\MSECache

==================== Find3M ====================

2009-01-12 13:25 111,616 a------- c:\windows\system32\userinit.exe
2009-01-04 18:38 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-04 18:38 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-12-28 16:25 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-10-23 08:01 283,648 a------- c:\windows\system32\gdi32.dll
2008-10-19 20:34 26,692 a------- c:\windows\Gameeeeee.pif
2008-10-16 05:37 659,456 a------- c:\windows\system32\wininet.dll

============= FINISH: 20:02:49.76 ===============


And this is the HijackTHis Notepad data:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:29:14 PM, on 1/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\frmwrk32.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ntdll64.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: {1c1be401-d168-0498-6c04-72c08066b30c} - {c03b6608-0c27-40c6-8940-861d104eb1c1} - C:\WINDOWS\system32\sakpfb.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [EPSON PictureMate] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2P1.EXE /P17 "EPSON PictureMate" /O6 "USB001" /M "PictureMate"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O20 - AppInit_DLLs: sakpfb.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 4574 bytes

Attached Files



BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:38 AM

Posted 13 January 2009 - 12:14 AM

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop.
  • Open the program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.


Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 amandam239

amandam239
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:38 PM

Posted 13 January 2009 - 10:24 AM

Wan, I can't thank you enough for responding to my post but... you want me to download Malwarebytes - in my post I said that I already have it downloaded, ran it and it found nothing...which I find amazing since my PC is so infected I can barely use it. It was a version I had on my PC before I got infected so I tried to run the update for Malwarebytes thinking that might help discover the virus, but whatever I'm infected with will not allow me to download the update - or any new anti-malware programs.

When I try to download the update or any anti-malware program, right before it's done downloading I get error messages & the invalid floating point error message.

Any other ideas? Maybe a closer look at the logs I posted would help? I'm desperate!

Edited by amandam239, 13 January 2009 - 10:26 AM.


#4 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:38 AM

Posted 13 January 2009 - 10:31 AM

Sorry.. Do this instead...



Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
  • If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".
  • During the download, rename Combofix to Combo-Fix as follows:

    Posted Image

    Posted Image

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      -----------------------------------------------------------

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    -----------------------------------------------------------

  • Double click on combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#5 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:38 AM

Posted 21 January 2009 - 03:48 PM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users