Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with PC antispyware 2010, cannot run mbam-setup.exe in order to remove


  • Please log in to reply
1 reply to this topic

#1 chewtoy

chewtoy

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:28 PM

Posted 03 September 2009 - 04:18 PM

Hi

my name is chewtoy and i have some how managed to get Infected with PC antispyware 2010...in addition the task manages
shows the presence of "b.exe"...i have never seen that before!

also, a red circle with a white "X" has appear next to the clock in the task bar

i think as a result of all this, the computer has begun occasionally switching to a blue screen that says something along the lines of - an error has occurred and that i should uninstalled any recently installed software...for there the only option i have is to turn off the laptop from the main power button

i did try to follow the instructions in the "do it yourself" section of the website but after downloading mbam-setup.exe i double clicked on the icon but nothing happened...it was as if the laptop was either refusing to run it or something was preventing it

i am no where near an expert with computers and have find myself way out of my depth...any help and/or advice you could give me would be immensely appreciated...thanks

the following is the DDS.txt you requested...thanks again


DDS (Ver_09-07-30.01) - NTFSx86
Run by migdet at 15:58:05.87 on Thu 09/03/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.75 [GMT -7:00]

AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: McAfee Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\sys32_nov.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\braviax.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\PC_Antispyware2010\PC_Antispyware2010.exe
C:\Documents and Settings\migdet\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/ymj/*http://www.yahoo.com
mSearchAssistant = hxxp://www.google.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: Show Norton Toolbar: {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.5\UIBHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [sys32_nov] c:\documents and settings\migdet\sys32_nov.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [braviax]
mRun: [DLBTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLBTtime.dll,_RunDLLEntry@16
mRun: [MMTray] "c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [snpstd] c:\windows\vsnpstd.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [sys32_nov] c:\windows\system32\sys32_nov.exe
mRun: [Regedit32] c:\windows\system32\regedit.exe
mRun: [braviax]
mRun: [PC Antispyware 2010] "c:\program files\pc_antispyware2010\PC_Antispyware2010.exe" /hide
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil9e.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1005.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxdev.dll
Notify: WRNotifier - WRLogonNTF.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\migdet\applic~1\mozilla\firefox\profiles\kw421jo4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\documents and settings\migdet\application data\move networks\plugins\npqmp071502000008.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {992B81BD-797B-4411-B615-3A3FEC84FD43} - c:\documents and settings\migdet\local settings\application data\{992B81BD-797B-4411-B615-3A3FEC84FD43}

============= SERVICES / DRIVERS ===============

R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 587096]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-1-9 108648]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090902.005\NAVENG.SYS [2009-9-2 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090902.005\NAVEX15.SYS [2009-9-2 1323568]
R3 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2009-3-11 1251720]
S3 EraserUtilDrv10920;EraserUtilDrv10920;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10920.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10920.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

=============== Created Last 30 ================

2009-09-03 15:53 17,707 a------- c:\windows\izaketuq.ban
2009-09-03 15:53 17,444 a------- c:\docume~1\alluse~1\applic~1\exaper.scr
2009-09-03 15:53 16,428 a------- c:\windows\system32\uxezevav.pif
2009-09-03 15:53 16,316 a------- c:\docume~1\migdet\applic~1\ysihazetuf.pif
2009-09-03 15:53 14,273 a------- c:\docume~1\alluse~1\applic~1\ijygehowav.scr
2009-09-03 15:53 13,620 a------- c:\program files\common files\apociqydez.sys
2009-09-03 15:53 13,457 a------- c:\windows\ypabuvesi.dat
2009-09-03 15:53 11,429 a------- c:\docume~1\alluse~1\applic~1\yvybogi.bin
2009-09-03 15:53 10,572 a------- c:\windows\system32\orezefy.inf
2009-09-03 15:52 <DIR> --d----- c:\program files\PC_Antispyware2010
2009-09-03 15:48 191,357 a------- c:\windows\system32\wisdstr.exe
2009-09-03 15:48 11,264 a------- c:\windows\system32\braviax.exe
2009-09-03 13:19 19,339 a------- c:\windows\system32\pekycu.lib
2009-09-03 13:19 19,212 a------- c:\windows\system32\ubetowat.db
2009-09-03 13:19 19,001 a------- c:\windows\ohit.pif
2009-09-03 13:19 17,338 a------- c:\program files\common files\ygygeduke.exe
2009-09-03 13:19 16,463 a------- c:\docume~1\alluse~1\applic~1\utaniq.com
2009-09-03 13:19 12,931 a------- c:\windows\system32\yguhygin.db
2009-09-03 13:19 18,615 a------- c:\docume~1\migdet\applic~1\onin.scr
2009-09-03 13:19 16,487 a------- c:\windows\system32\nybeqy.pif
2009-09-03 13:19 15,570 a------- c:\windows\system32\kizegefi.lib
2009-09-03 13:19 14,045 a------- c:\windows\azijuge._dl
2009-09-03 13:19 12,063 a------- c:\windows\ynaxajo.scr
2009-09-03 13:19 11,480 a------- c:\windows\ogijyzuw.vbs
2009-09-03 08:33 19,910 a------- c:\windows\sizicuc.vbs
2009-09-03 08:33 16,184 a------- c:\windows\dupif.bin
2009-09-03 08:33 14,552 a------- c:\docume~1\alluse~1\applic~1\ocufisot.reg
2009-09-03 08:33 12,013 a------- c:\docume~1\alluse~1\applic~1\yjoc.dll
2009-09-03 08:33 11,223 a------- c:\docume~1\alluse~1\applic~1\idihygelix.dll
2009-09-03 08:33 10,074 a------- c:\docume~1\alluse~1\applic~1\ohoderupeq.dll
2009-09-02 21:31 7,396 a------- c:\windows\system32\drivers\pctcore.cat
2009-09-02 20:36 <DIR> --ds---- C:\Combo-Fix
2009-09-02 20:35 388,608 a------- c:\windows\system32\CF775.exe
2009-09-02 16:03 18,093 a------- c:\windows\system32\kalitekimi.db
2009-09-02 16:03 12,552 a------- c:\windows\dicatufef._sy
2009-09-02 16:03 11,612 a------- c:\windows\usyvuhoq._sy
2009-09-02 13:47 11,584 a------- c:\windows\hoxibinu._sy
2009-09-02 13:47 18,859 a------- c:\windows\system32\lelohy.dat
2009-09-02 13:46 <DIR> --d----- c:\windows\system32\dllcache\cache
2009-09-02 11:29 <DIR> --ds---- C:\ComboFix
2009-09-02 10:13 17,440 a------- c:\program files\common files\ijomy.dat
2009-09-02 10:13 16,038 a------- c:\windows\memir.com
2009-09-02 10:13 14,714 a------- c:\windows\system32\ygoko.com
2009-09-02 10:13 12,395 a------- c:\windows\system32\bipufud._sy
2009-09-02 10:13 13,822 a------- c:\windows\rosahihara.dat
2009-09-02 01:37 118 a------- c:\windows\system32\MRT.INI
2009-09-02 01:34 <DIR> --d----- c:\windows\ServicePackFiles
2009-09-02 01:31 <DIR> --d----- C:\cmdcons
2009-09-02 01:29 229,888 a------- c:\windows\PEV.exe
2009-09-02 01:29 161,792 a------- c:\windows\SWREG.exe
2009-09-02 01:29 98,816 a------- c:\windows\sed.exe
2009-09-02 01:03 655,872 -------- c:\windows\system32\dllcache\mstscax.dll
2009-09-02 01:00 215,552 -------- c:\windows\system32\dllcache\wordpad.exe
2009-09-01 18:54 120 a------- c:\windows\Rjeweze.dat
2009-09-01 18:52 18,308 a------- c:\windows\juwatagiz.db
2009-09-01 18:45 29,216 a------- c:\windows\system32\sys32_nov.exe
2009-09-01 14:49 <DIR> --d----- c:\program files\ASIO4ALL v2
2009-09-01 14:46 225,280 a------- c:\windows\system32\rewire.dll
2009-09-01 14:46 <DIR> --d----- c:\program files\VstPlugins
2009-09-01 14:46 1,294,336 a------- c:\windows\system32\vorbis.acm
2009-09-01 14:44 <DIR> --d----- c:\program files\Image-Line
2009-09-01 14:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2009-09-01 14:40 <DIR> --d----- c:\program files\DAEMON Tools Toolbar
2009-09-01 14:40 <DIR> --d----- c:\program files\DAEMON Tools Lite
2009-09-01 14:35 721,904 a------- c:\windows\system32\drivers\sptd.sys
2009-09-01 14:35 <DIR> --d----- c:\docume~1\migdet\applic~1\DAEMON Tools Lite
2009-08-17 12:37 <DIR> --d----- c:\program files\MagicISO
2009-08-16 20:02 <DIR> --d----- c:\program files\UltraISO
2009-08-05 02:11 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

==================== Find3M ====================

2009-09-03 15:53 18,890 a------- c:\program files\common files\ywut.ban
2009-09-03 15:48 94,272 a------- c:\windows\system32\drivers\agp440.sys
2009-09-03 15:48 94,272 a------- c:\windows\system32\dllcache\agp440.sys
2009-09-03 13:19 19,328 a------- c:\program files\common files\arunygogyz.ban
2009-09-03 08:33 13,715 a------- c:\program files\common files\axepox.inf
2009-09-02 15:39 10,166 a------- c:\program files\eozixst.txt
2009-08-27 20:44 7,778 a------- c:\docume~1\migdet\applic~1\wklnhst.dat
2009-08-05 02:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-28 21:53 119,808 a------- c:\windows\system32\t2embed.dll
2009-07-28 21:53 82,432 a------- c:\windows\system32\fontsub.dll
2009-07-28 21:53 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-07-28 21:53 82,432 -------- c:\windows\system32\dllcache\fontsub.dll
2009-07-19 06:33 3,597,824 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-19 06:33 3,597,824 a------- c:\windows\system32\dllcache\cache\mshtml.dll
2009-07-19 06:32 6,067,200 -------- c:\windows\system32\dllcache\ieframe.dll
2009-07-17 11:55 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 11:55 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 10,841,088 a------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-10 06:42 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-06-29 04:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-06-29 04:07 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-29 01:35 634,632 -------- c:\windows\system32\dllcache\iexplore.exe
2009-06-29 01:33 2,452,872 -------- c:\windows\system32\dllcache\ieapfltr.dat
2009-06-29 01:33 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2009-06-25 01:44 724,480 a------- c:\windows\system32\lsasrv.dll
2009-06-25 01:44 298,496 a------- c:\windows\system32\kerberos.dll
2009-06-25 01:44 168,448 a------- c:\windows\system32\schannel.dll
2009-06-25 01:44 133,632 a------- c:\windows\system32\msv1_0.dll
2009-06-25 01:44 59,392 a------- c:\windows\system32\wdigest.dll
2009-06-25 01:44 56,320 a------- c:\windows\system32\secur32.dll
2009-06-25 01:44 724,480 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 01:44 298,496 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 01:44 168,448 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 01:44 133,632 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 01:44 59,392 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-25 01:44 56,320 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-22 04:34 92,544 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-06-12 04:50 76,288 a------- c:\windows\system32\telnet.exe
2009-06-12 04:50 76,288 -------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 07:21 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 07:21 84,992 -------- c:\windows\system32\dllcache\avifil32.dll
2009-06-09 23:32 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-09 23:32 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll
2007-04-27 09:54 1,940 a------- c:\docume~1\migdet\applic~1\ViewerApp.dat
2006-01-16 19:46 70,040 a------- c:\docume~1\migdet\applic~1\GDIPFONTCACHEV1.DAT

============= FINISH: 15:58:23.81 ===============

Attached Files


Edited by chewtoy, 03 September 2009 - 06:36 PM.


BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:12:28 AM

Posted 04 September 2009 - 02:57 PM

Hello! :(
My name is Sam and I will be helping you.

In order to see what's going on with your computer I'll ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.



Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.



Make sure that you save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users