Summary of problem: Olmarik trojan -> combofix -> extremely slow operation under non-safe mode environment.
I am trying to remove all the malware from a friends computer and am having trouble. Have been running MBAM, SpybotS&D, and NOD32 in an attempt to remove the malware and was mostly successful until I found out that ESET NOD32 gave me a message that Olmarik Trojan cannot be cleared.
I googled the trojan and found a website describing how an individual had removed it using combofix:http://www.pchelpforum.com/fixed-hijackthi...y-computer.html
I know that this fix was specialized for this individual but I decided to take a chance and use combofix without proper guidance.
And so I dont think it was worth the risk
My friends computer is running Win XP Home x86 SP1 which I was going to update after removing malware.
Computer was not connected to internet when combofix was run so the recovery console was not installed and combofix scanned the computer. Since then, running XP in normal mode is painstakingly slow - taking 1 hour to get to the desktop slow. I have to revert to using safemode to perform tasks. While in safe mode, there is a c:\combofix folder that points back to c:\ . A C:\QOOBOX folder has been created with I presume the normal stuff you would find, the most useful file I could find was LogA which contains:
Script file located at: \??\C:\ComboFix\ComboDel.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\QooBox
Beginning to process script file:
File move operation C:\WINDOWS\system32\drivers\gasfkyothjdaay.sys|C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\gasfkyothjdaay.sys.vir completed successfully.
File move operation C:\WINDOWS\system32\gasfkykhardgpk.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\gasfkykhardgpk.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\gasfkylsjsclft.dat|C:\QooBox\Quarantine\C\WINDOWS\system32\gasfkylsjsclft.dat.vir completed successfully.
File move operation C:\WINDOWS\system32\gasfkybrawxfis.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\gasfkybrawxfis.dll.vir completed successfully.
File move operation C:\WINDOWS\system32\gasfkygruekxsf.dat|C:\QooBox\Quarantine\C\WINDOWS\system32\gasfkygruekxsf.dat.vir completed successfully.
File move operation C:\WINDOWS\system32\gasfkyfpetjsau.dll|C:\QooBox\Quarantine\C\WINDOWS\system32\gasfkyfpetjsau.dll.vir completed successfully.
Program C:\ComboFix\C.bat successfully set up to run once on reboot.
Completed script processing.
Fatal error: integrity of Services key failed verification check! Security may be fatally compromised. Exiting immediately.
Could not open script file! Status: 0xc0000034 Abort!
I would also like to add that my friend became aware of problem when Total Security Malware infected the computer which has been ?removed? by the deletion of c:\program files\TS
Please help me get windows to function properly and I promise not to use combofix on my own again!