Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Need helpwith malware removal  (Read 10175 times)

0 Members and 1 Guest are viewing this topic.

pctsvs

    Topic Starter


    Rookie

    Need helpwith malware removal
    « on: January 03, 2009, 10:21:07 AM »
    I read the topic on read this first before asking for malware removal and I was only able to download HiJack this.  Everytime I download anything else, it stops me in the middle or the webpage says server cannot be found.  Everytime I even try to open up a webpage with anything to do with malware or virus removal it says server cannot be found.  I have Vundo and Monder at least that is what my anitspyware is showing.  It asks to fix and remove, but another scan just shows that it is back.

    Below is the log for HJT since it is the only thing that I can run from your steps to malware removal. 


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:16:13 AM, on 1/3/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\LEXBCES.EXE
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\system32\LEXPPS.EXE
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\crypserv.exe
    c:\program files\mcafee.com\agent\mcdetect.exe
    c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\Lexmark 3300 Series\lxccmon.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINNT\system32\rundll32.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\WINNT\System32\lxcccoms.exe
    C:\Program Files\Antispyware\Antispyware.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [742667e9] rundll32.exe "C:\WINNT\system32\hqsrtacl.dll",b
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKCU\..\Run: [Antispyware] C:\Program Files\Antispyware\Antispyware.exe -boot
    O4 - Startup: .protected
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
    O9 - Extra button: (no name) - {60AFE1CD-9BA1-47AC-929C-484FBA08DF62} - (no file)
    O9 - Extra button: (no name) - {C7112EF1-D5B6-421D-8F58-8FA63AB144F8} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
    O12 - Plugin for ク跼: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
    O15 - Trusted Zone: *.mcafee.com
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Insaniquarium Deluxe\Images\stg_drm.ocx
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://flora-ds.flora.nal.com/iNotes6W.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://chrissysturm.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1452/ftp.coupons.com/r3302/cpbrkpie.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
    O16 - DPF: {C32F59BF-180B-416A-ABF7-161060990A88} - http://download.verizon.net/sfp/Cabs/max_update/cVOLUpdate_1-0-0.cab
    O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Yahtzee\Images\armhelper.ocx
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://aolsvc.aol.com/onlinegames/bejeweled2/popcaploader_v10.cab
    O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://flora-ds.flora.nal.com/dwa7W.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5371/mcfscan.cab
    O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{93CD98A1-7237-4EAE-8067-B173062A6FD6}: NameServer = 68.238.0.12 68.238.112.12
    O18 - Filter hijack: text/html - {e231cfca-2218-4076-a0fd-c64d38ac913d} - C:\WINNT\system32\mst120.dll
    O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
    O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINNT\System32\lxcccoms.exe
    O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:\WINNT\System32\wgareg.exe (file missing)

    --
    End of file - 8146 bytes





    CBMatt

    • Mod & Malware Specialist


    • Prodigy

    • Sad and lonely...and loving every minute of it.
    • Thanked: 167
      • Yes
    • Experience: Experienced
    • OS: Windows 7
    Re: Need helpwith malware removal
    « Reply #1 on: January 04, 2009, 05:16:04 PM »
    Click Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.
    • Scroll down to "Non-plug and Play Drivers" and click the plus icon to open those drivers.
    • Then search for TDSSserv.sys
    • Let me know if you find this or not.
    • If you do find it, right click on it, and select "Disable". Do not try to uninstall it.
    • Also if this is found and you disable it, then reboot and see if you can run the other scans that would not run.

    Are you able to follow the instructions from THIS PAGE now?
    Quote
    An undefined problem has an infinite number of solutions.
    由obert A. Humphrey

    pctsvs

      Topic Starter


      Rookie

      Re: Need helpwith malware removal
      « Reply #2 on: January 04, 2009, 06:52:48 PM »
      Thanks for the reply CBMatt, but I read a post on this and tried it already.  I could not find the TDSSserv.sys in the place that you mention.  I was finally able to download SuperAntispyware and I have attached the log below.  I am going to try and download the MBAM now and see what I can do.  I will post back probably tomorrow with my results.

      SUPERAntiSpyware Scan Log
      http://www.superantispyware.com

      Generated 01/04/2009 at 07:07 PM

      Application Version : 4.24.1004

      Core Rules Database Version : 3688
      Trace Rules Database Version: 1664

      Scan type       : Complete Scan
      Total Scan Time : 01:12:14

      Memory items scanned      : 370
      Memory threats detected   : 0
      Registry items scanned    : 6640
      Registry threats detected : 5
      File items scanned        : 123885
      File threats detected     : 2

      Registry Cleaner Trial
         HKCR\Install.Install
         HKCR\Install.Install\CLSID
         HKCR\Install.Install\CurVer
         HKCR\Install.Install.1
         HKCR\Install.Install.1\CLSID

      Adware.EZSearching
         C:\WINNT\SYSTEM32\CTSR5.DLL

      Trojan.Vundo-Variant/Small-GEN
         C:\WINNT\SYSTEM32\DDCCRHWQ.DLL







      I also was able to finally download Avira AntiVir Personal - free Antivirus and I have attached the log for this too.  Just so you know, I ran the antivirus first then ran the antispyware.





      Avira AntiVir Personal
      Report file date: Sunday, January 04, 2009  16:47

      Scanning for 1038808 virus strains and unwanted programs.

      Licensed to:      Avira AntiVir PersonalEdition Classic
      Serial number:    0000149996-ADJIE-0001
      Platform:         Windows XP
      Windows version:  (Service Pack 3)  [5.1.2600]
      Boot mode:        Normally booted
      Username:         SYSTEM
      Computer name:    S1100011277

      Version information:
      BUILD.DAT     : 8.2.0.337      16934 Bytes  11/18/2008 13:05:00
      AVSCAN.EXE    : 8.1.4.10      315649 Bytes  11/18/2008 15:21:26
      AVSCAN.DLL    : 8.1.4.0        40705 Bytes   5/26/2008 14:56:40
      LUKE.DLL      : 8.1.4.5       164097 Bytes   6/12/2008 19:44:19
      LUKERES.DLL   : 8.1.4.0        12033 Bytes   5/26/2008 14:58:52
      ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  10/27/2008 18:30:36
      ANTIVIR1.VDF  : 7.1.0.56      411136 Bytes   11/9/2008 23:57:13
      ANTIVIR2.VDF  : 7.1.0.89      221184 Bytes  11/16/2008 23:16:47
      ANTIVIR3.VDF  : 7.1.0.97       45056 Bytes  11/17/2008 23:38:59
      Engineversion : 8.2.0.31 
      AEVDF.DLL     : 8.1.0.6       102772 Bytes  10/14/2008 17:05:56
      AESCRIPT.DLL  : 8.1.1.15      332156 Bytes  11/11/2008 21:00:07
      AESCN.DLL     : 8.1.1.5       123251 Bytes   11/7/2008 22:06:41
      AERDL.DLL     : 8.1.1.3       438645 Bytes   11/4/2008 20:58:38
      AEPACK.DLL    : 8.1.3.4       393591 Bytes  11/11/2008 16:41:39
      AEOFFICE.DLL  : 8.1.0.30      196986 Bytes   11/7/2008 22:06:41
      AEHEUR.DLL    : 8.1.0.71     1487222 Bytes   11/7/2008 22:06:41
      AEHELP.DLL    : 8.1.1.3       119157 Bytes   11/7/2008 22:06:41
      AEGEN.DLL     : 8.1.1.0       319859 Bytes   11/7/2008 22:06:41
      AEEMU.DLL     : 8.1.0.9       393588 Bytes  10/14/2008 17:05:56
      AECORE.DLL    : 8.1.4.1       172405 Bytes   11/7/2008 22:06:41
      AEBB.DLL      : 8.1.0.3        53618 Bytes  10/14/2008 17:05:56
      AVWINLL.DLL   : 1.0.0.12       15105 Bytes    7/9/2008 15:40:05
      AVPREF.DLL    : 8.0.2.0        38657 Bytes   5/16/2008 16:28:01
      AVREP.DLL     : 8.0.0.2        98344 Bytes   7/31/2008 19:02:15
      AVREG.DLL     : 8.0.0.1        33537 Bytes    5/9/2008 18:26:40
      AVARKT.DLL    : 1.0.0.23      307457 Bytes   2/12/2008 15:29:23
      AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes   6/12/2008 19:27:49
      SQLITE3.DLL   : 3.3.17.1      339968 Bytes   1/23/2008 00:28:02
      SMTPLIB.DLL   : 1.2.0.23       28929 Bytes   6/12/2008 19:49:40
      NETNT.DLL     : 8.0.0.1         7937 Bytes   1/25/2008 19:05:10
      RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes   6/12/2008 20:48:07
      RCTEXT.DLL    : 8.0.52.0       86273 Bytes   6/27/2008 20:34:37

      Configuration settings for the scan:
      Jobname..........................: Complete system scan
      Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
      Logging..........................: low
      Primary action...................: interactive
      Secondary action.................: ignore
      Scan master boot sector..........: on
      Scan boot sector.................: on
      Boot sectors.....................: C:,
      Process scan.....................: on
      Scan registry....................: on
      Search for rootkits..............: off
      Scan all files...................: Intelligent file selection
      Scan archives....................: on
      Recursion depth..................: 20
      Smart extensions.................: on
      Macro heuristic..................: on
      File heuristic...................: medium

      Start of the scan: Sunday, January 04, 2009  16:47

      The scan of running processes will be started
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'iexplore.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'alg.exe' - '1' Module(s) have been scanned
      Scan process 'McShield.exe' - '1' Module(s) have been scanned
      Scan process 'msfwsvc.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'mcvsrte.exe' - '1' Module(s) have been scanned
      Scan process 'McTskshd.exe' - '1' Module(s) have been scanned
      Scan process 'Mcdetect.exe' - '1' Module(s) have been scanned
      Scan process 'Crypserv.exe' - '1' Module(s) have been scanned
      Scan process 'SUPERAntiSpyware.exe' - '1' Module(s) have been scanned
      Scan process 'Antispyware.exe' - '1' Module(s) have been scanned
      Scan process 'jusched.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      31 processes with 31 modules were scanned

      Starting master boot sector scan:
      Master boot sector HD0
          [INFO]      No virus was found!

      Start scanning boot sectors:
      Boot sector 'C:\'
          [INFO]      No virus was found!

      Starting to scan the registry.
      The registry was scanned ( '52' files ).


      Starting the file scan:

      Begin scan in 'C:\' <Sturm>
      C:\pagefile.sys
          [WARNING]   The file could not be opened!
      C:\System Volume Information\_restore{7DCA1BE4-D752-48D6-A25E-C722C8FD1BC4}\RP1537\A0112761.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '499246a2.qua'!
      C:\System Volume Information\_restore{7DCA1BE4-D752-48D6-A25E-C722C8FD1BC4}\RP1537\A0112762.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '499246a8.qua'!
      C:\System Volume Information\_restore{7DCA1BE4-D752-48D6-A25E-C722C8FD1BC4}\RP1537\A0112763.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '499246ac.qua'!
      C:\WINNT\system32\agbaolrv.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49c349b7.qua'!
      C:\WINNT\system32\dxwoau(2).dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49d849da.qua'!
      C:\WINNT\system32\ffaqspsq.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49c249cd.qua'!
      C:\WINNT\system32\nzbzso.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49c34a04.qua'!
      C:\WINNT\system32\pmnnOIYo.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49cf49fd.qua'!
      C:\WINNT\system32\qwdonynh.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49c54a0d.qua'!
      C:\WINNT\system32\wjtycg.dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [WARNING]   An error has occurred and the file was not deleted. ErrorID: 26003
          [WARNING]   The file could not be deleted!
          [NOTE]      Attempting to perform action using the ARK lib.
          [NOTE]      The file was moved to '4b8ecb53.qua'!
      C:\WINNT\system32\wvUmmKEU(2).dll
            [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
          [NOTE]      The file was moved to '49b64a2c.qua'!


      End of the scan: Sunday, January 04, 2009  17:45
      Used time: 57:14 Minute(s)

      The scan has been done completely.

         9384 Scanning directories
       341063 Files were scanned
           11 viruses and/or unwanted programs were found
            0 Files were classified as suspicious:
            0 files were deleted
            0 files were repaired
           11 files were moved to quarantine
            0 files were renamed
            1 Files cannot be scanned
       341051 Files not concerned
        14639 Archives were scanned
            2 Warnings
           11 Notes

      pctsvs

        Topic Starter


        Rookie

        Re: Need helpwith malware removal
        « Reply #3 on: January 04, 2009, 07:17:03 PM »
        Ok I just tried again to download MBAM and I keep getting a server timed out.  It just isn't going to let me download it.  I will wait for the next step from you guys.

        Thank you very much.

        pctsvs

          Topic Starter


          Rookie

          Re: Need helpwith malware removal
          « Reply #4 on: January 04, 2009, 08:01:40 PM »
          Ok now nevermind my last post.  I was finally able to download MBAM from brothersoft website.  I have the log posted here.  I am getting ready to run HJT again and I will post the log on my next post here in a minute.


          Malwarebytes' Anti-Malware 1.26
          Database version: 1103
          Windows 5.1.2600 Service Pack 3

          1/4/2009 8:48:55 PM
          mbam-log-2009-01-04 (20-48-43).txt

          Scan type: Quick Scan
          Objects scanned: 49294
          Time elapsed: 3 minute(s), 9 second(s)

          Memory Processes Infected: 0
          Memory Modules Infected: 0
          Registry Keys Infected: 17
          Registry Values Infected: 1
          Registry Data Items Infected: 1
          Folders Infected: 1
          Files Infected: 10

          Memory Processes Infected:
          (No malicious items detected)

          Memory Modules Infected:
          (No malicious items detected)

          Registry Keys Infected:
          HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken.
          HKEY_CLASSES_ROOT\Interface\{7b178417-3cda-444f-94ff-312c0a3a78a8} (Adware.180Solutions) -> No action taken.
          HKEY_CLASSES_ROOT\Interface\{986a8ac1-ab4d-4f41-9068-4b01c0197867} (Trojan.BHO) -> No action taken.
          HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> No action taken.
          HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> No action taken.
          HKEY_CLASSES_ROOT\CLSID\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> No action taken.
          HKEY_CLASSES_ROOT\Typelib\{8e3c68cd-f500-4a2a-8cb9-132bb38c3573} (Trojan.BHO) -> No action taken.
          HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> No action taken.
          HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> No action taken.
          HKEY_CLASSES_ROOT\Typelib\{68bf4626-d66b-4383-a6af-62e57e9b6cd4} (Adware.180Solutions) -> No action taken.
          HKEY_CLASSES_ROOT\AppID\{a0e1054b-01ee-4d57-a059-4d99f339709f} (Trojan.BHO) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> No action taken.
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.

          Registry Values Infected:
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antispyware (Rogue.Antispyware) -> No action taken.

          Registry Data Items Infected:
          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn (Hijack.Desktop) -> Bad: (1) Good: (0) -> No action taken.

          Folders Infected:
          C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware (Rogue.Antispyware) -> No action taken.

          Files Infected:
          C:\Program Files\Common\_helper.dll (Trojan.BHO) -> No action taken.
          C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware\Antispyware on the Web.lnk (Rogue.Antispyware) -> No action taken.
          C:\Documents and Settings\All Users\Start Menu\Programs\Antispyware\Antispyware.lnk (Rogue.Antispyware) -> No action taken.
          C:\Program Files\Common\helper.dll (Trojan.BHO) -> No action taken.
          C:\WINNT\system32\mcrh.tmp (Malware.Trace) -> No action taken.
          C:\WINNT\cookies.ini (Malware.Trace) -> No action taken.
          C:\WINNT\inf\ultra.PNF (Malware.Trace) -> No action taken.
          C:\Documents and Settings\All Users\Desktop\Antispyware.lnk (Rogue.Antispyware) -> No action taken.
          C:\Documents and Settings\Owner\Desktop\antivirus scan 1-4-09.txt (Rogue.Link) -> No action taken.
          C:\Documents and Settings\Owner\Start Menu\Programs\Startup\.protected (Rogue.Multiple) -> No action taken.

          pctsvs

            Topic Starter


            Rookie

            Re: Need helpwith malware removal
            « Reply #5 on: January 04, 2009, 08:10:07 PM »
            Here is my post with HJT (sniper) attached.  I will now sit tight and await the next step from you guys.  Again, thanks for your help.



            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 9:05:01 PM, on 1/4/2009
            Platform: Windows XP SP3 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
            Boot mode: Normal

            Running processes:
            C:\WINNT\System32\smss.exe
            C:\WINNT\system32\winlogon.exe
            C:\WINNT\system32\services.exe
            C:\WINNT\system32\lsass.exe
            C:\WINNT\system32\svchost.exe
            C:\WINNT\System32\svchost.exe
            C:\Program Files\Sygate\SPF\smc.exe
            C:\WINNT\system32\LEXBCES.EXE
            C:\WINNT\system32\spoolsv.exe
            C:\WINNT\system32\LEXPPS.EXE
            C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
            C:\WINNT\Explorer.EXE
            C:\Program Files\Java\jre6\bin\jusched.exe
            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
            C:\WINNT\system32\crypserv.exe
            c:\program files\mcafee.com\agent\mcdetect.exe
            c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
            c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
            C:\WINNT\System32\svchost.exe
            C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
            c:\PROGRA~1\mcafee.com\vso\mcshield.exe
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\WINNT\system32\rundll32.exe
            C:\Program Files\Trend Micro\HijackThis\Sniper.exe.exe

            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_search
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
            R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
            O2 - BHO: {3d02fdd0-4380-ecc9-90f4-b3739b6da3c4} - {4c3ad6b9-373b-4f09-9cce-08340ddf20d3} - (no file)
            O2 - BHO: (no name) - {5FC2621A-CA45-4743-B929-83318F627267} - (no file)
            O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
            O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
            O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
            O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
            O9 - Extra button: (no name) - {60AFE1CD-9BA1-47AC-929C-484FBA08DF62} - (no file)
            O9 - Extra button: (no name) - {C7112EF1-D5B6-421D-8F58-8FA63AB144F8} - (no file)
            O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
            O12 - Plugin for ク跼: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
            O15 - Trusted Zone: *.mcafee.com
            O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
            O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Insaniquarium Deluxe\Images\stg_drm.ocx
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
            O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
            O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
            O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://flora-ds.flora.nal.com/iNotes6W.cab
            O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
            O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://chrissysturm.spaces.live.com//PhotoUpload/MsnPUpld.cab
            O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
            O16 - DPF: {C32F59BF-180B-416A-ABF7-161060990A88} - http://download.verizon.net/sfp/Cabs/max_update/cVOLUpdate_1-0-0.cab
            O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Yahtzee\Images\armhelper.ocx
            O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://flora-ds.flora.nal.com/dwa7W.cab
            O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5371/mcfscan.cab
            O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{93CD98A1-7237-4EAE-8067-B173062A6FD6}: NameServer = 68.238.0.12 68.238.112.12
            O18 - Filter hijack: text/html - {e231cfca-2218-4076-a0fd-c64d38ac913d} - C:\WINNT\system32\mst120.dll
            O20 - AppInit_DLLs: wjtycg.dll
            O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
            O20 - Winlogon Notify: xxYrRKEU - xxYrRKEU.dll (file missing)
            O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
            O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
            O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
            O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
            O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINNT\System32\lxcccoms.exe
            O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
            O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
            O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
            O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
            O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
            O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
            O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
            O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:\WINNT\System32\wgareg.exe (file missing)

            --
            End of file - 7909 bytes

            CBMatt

            • Mod & Malware Specialist


            • Prodigy

            • Sad and lonely...and loving every minute of it.
            • Thanked: 167
              • Yes
            • Experience: Experienced
            • OS: Windows 7
            Re: Need helpwith malware removal
            « Reply #6 on: January 05, 2009, 04:07:39 PM »
            Okay, we're making some progress.  It looks like the files found by MBAM weren't deleted.  Scan again, and this time, be sure to instruct it to remove the infections.  Then download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

            http://download.bleepingcomputer.com/sUBs/ComboFix.exe
            http://subs.geekstogo.com/ComboFix.exe

            Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

            Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

            Double-click combofix.exe and follow the prompts.
            When finished, ComboFix will produce a log for you.
            Post the ComboFix log and a new HijackThis log in your next reply.

            NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

            Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.
            Quote
            An undefined problem has an infinite number of solutions.
            由obert A. Humphrey

            pctsvs

              Topic Starter


              Rookie

              Re: Need helpwith malware removal
              « Reply #7 on: January 06, 2009, 02:22:23 AM »
              I thought we were making some progress.  I took my son to his boy scout meeting and when I came back home my wife said that the internet wouldn't come up.  I tried everything I could, so I had to call Verizon.  They ran me through a bunch of steps and finally determined that my Ethernet cable was not working.  I'm not sure how that happened, since I was just on the internet 2hrs before it quit working.  I will have to get another cable before I can get back on my computer and get the internet to work.  I am currently checking this post from another computer.  I will run MBAM again and then run combofix.  I will post the logs here when I get my computer running.  Thanks.

              CBMatt

              • Mod & Malware Specialist


              • Prodigy

              • Sad and lonely...and loving every minute of it.
              • Thanked: 167
                • Yes
              • Experience: Experienced
              • OS: Windows 7
              Re: Need helpwith malware removal
              « Reply #8 on: January 06, 2009, 03:46:24 PM »
              It may just be some weird random coincidence.  In any case, I'll be here whenever you can get the logs posted.
              Quote
              An undefined problem has an infinite number of solutions.
              由obert A. Humphrey

              pctsvs

                Topic Starter


                Rookie

                Re: Need helpwith malware removal
                « Reply #9 on: January 06, 2009, 08:10:22 PM »
                I clicked on the post button but it said that I had already submitted this post.  I didn't see it so I opened it back up and am resending with the logs.  I apologize if this is on here twice.



                [attachment deleted by admin]

                CBMatt

                • Mod & Malware Specialist


                • Prodigy

                • Sad and lonely...and loving every minute of it.
                • Thanked: 167
                  • Yes
                • Experience: Experienced
                • OS: Windows 7
                Re: Need helpwith malware removal
                « Reply #10 on: January 07, 2009, 03:20:13 PM »
                Sorry, this is a glitch that occurs every once in awhile.  But no worries, your post only showed up once.  Since you are posting, does this mean that a new ethernet cable fixed your connection problem?  Anyway, let's see if we can clean things up a bit...

                Once we start, you won't have access to this post anymore, so I recommend that you print out this post or save it to a Notepad file.  Open HijackThis and scan again.  Check the following entries, but don't do anything to them yet...

                O9 - Extra button: (no name) - {60AFE1CD-9BA1-47AC-929C-484FBA08DF62} - (no file)
                O9 - Extra button: (no name) - {C7112EF1-D5B6-421D-8F58-8FA63AB144F8} - (no file)


                Now, close all windows (including this one) besides HijackThis, then click Fix Checked.  Close HijackThis and then do the following...

                Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

                Delete these files/folders, as follows:

                1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
                It must be Notepad, not Wordpad.
                2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

                Code: [Select]
                KillAll::

                Folder::
                c:\program files\Common Files\Winferno

                File::
                c:\winnt\system32\mswinsck.ocx
                c:\winnt\system32\wjtycg.dll
                c:\winnt\system\wjtycg.dll
                c:\winnt\wjtycg.dll

                Registry::
                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                "AppInit_DLLs"=-

                3. Go to the Notepad window and click Edit > Paste
                4. Then click File > Save
                5. Name the file CFScript.txt - Save the file to your Desktop
                6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



                ComboFix will begin to execute, just follow the prompts.
                After reboot (in case it asks to reboot), it will produce a log for you.
                Post that log (Combofix.txt) in your next reply, along with a new HijackThis log.

                Note: Do not click ComboFix's window while it is running. That may cause your system to freeze
                Quote
                An undefined problem has an infinite number of solutions.
                由obert A. Humphrey

                pctsvs

                  Topic Starter


                  Rookie

                  Re: Need helpwith malware removal
                  « Reply #11 on: January 08, 2009, 08:31:47 AM »
                  Ok,   I have completed all that you asked and have attached the combofix and HJT logs as requested.  Thank you for your reply.


                  [attachment deleted by admin]

                  CBMatt

                  • Mod & Malware Specialist


                  • Prodigy

                  • Sad and lonely...and loving every minute of it.
                  • Thanked: 167
                    • Yes
                  • Experience: Experienced
                  • OS: Windows 7
                  Re: Need helpwith malware removal
                  « Reply #12 on: January 08, 2009, 02:49:14 PM »
                  Alright, your logs look a lot better!  How is your computer running now?  Are you still having problems or do things appear to be normal?
                  Quote
                  An undefined problem has an infinite number of solutions.
                  由obert A. Humphrey

                  pctsvs

                    Topic Starter


                    Rookie

                    Re: Need helpwith malware removal
                    « Reply #13 on: January 08, 2009, 06:26:34 PM »
                    Yes my computer does seem to be running better, thanks for the help in getting this off my system.  I do have a few questions though.

                    Do I leave all the stuff I downloaded on my computer?
                    I downloaded combofix, HJT and then renamed it sniper, MBAM, SuperAntispyware and Avira Antivir.

                    I also downloaded Sygate personal firewall.  Is this a good firewall to have?

                    CBMatt

                    • Mod & Malware Specialist


                    • Prodigy

                    • Sad and lonely...and loving every minute of it.
                    • Thanked: 167
                      • Yes
                    • Experience: Experienced
                    • OS: Windows 7
                    Re: Need helpwith malware removal
                    « Reply #14 on: January 08, 2009, 11:41:43 PM »
                    Avira is a good program, but you can't keep that and McAfee running at the same time.  You will have to disable or remove one of them because if you use them both, it will create problems and it could put you at risk.  Decide which program you like best and get rid of the other one.

                    Sygate is a good firewall to have.  Go ahead and keep it.

                    You should also keep MBAM and SAS.  You don't have to, of course, but they are very good programs to have.  Scan with them every week or two.

                    Feel free to remove HijackThis if you wish.  You can always download it again if you need it.  ComboFix should definitely be removed.  It's the type of program that should only be used when instructed, so it's best to just get rid of it until you need it again.  Go to Start > Run and type combofix /u (note the space between combofix and /u) and click OK.

                    If that doesn't work, then download OTCleanIt.exe and save it to your Desktop.
                    • Double-click OTCleanIt.exe.
                    • Click the CleanUp! button.
                    • Select Yes when the "Begin cleanup Process?" prompt appears.
                    • If you are prompted to Reboot during the cleanup, select Yes.
                    • The tool will delete itself once it finishes, if not delete it yourself.
                    Quote
                    An undefined problem has an infinite number of solutions.
                    由obert A. Humphrey