virus? malware? os? computer stupid?

[taydan030109]

here is the scan from combofix

[attachment deleted by admin]

[evilfantasy]

Download DDS by sUBs and save it to your Desktop. Alternate DDS download link

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or forewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs:

1) DDS.txt
2) Attach.txt

* Save both logs to your desktop.
* Please include the entire contents of both logs in your next reply.

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copy and pasting it into the reply.

[taydan030109]

attached logs

[attachment deleted by admin]

[evilfantasy]

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

DDS::
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

Folder::
c:\programdata\ParetoLogic
c:\program files\common files\ParetoLogic
c:\progra~2\ParetoLogic
c:\program files\RegCure

File::
c:\windows\Tasks\ParetoLogic Registration.job
c:\users\corey\AppData\Local\Temp\catchme.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

----------

Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

First install the new Sun Java Runtime Environment

Be sure to close all browser windows before beginning the install.

Remove the old version(s)

Download JavaRa

• Unzip the file and open the JavaRa.exe
• Click Remove Older Versions
  
• JavaRa will search for and remove any outdated version of Java and remove any that are found.
• Click Additional Tasks
  
• Place a check next to Remove Useless JRE Files and click Go
  
• Exit JavaRa
  
• Delete the JavaRa files from the Desktop

.
Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

Go to Add or Remove programs and uninstall:

-Java(TM) 6 Update 7

[taydan030109]

another log for you!

[taydan030109]

here

[attachment deleted by admin]

[evilfantasy]

OK how is the computer running now?

[taydan030109]

everything is still the same as my very first post

[evilfantasy]

Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start
  
• An information notice will appear, click OK.
  
• This starts a short scan that will scan the files currently running in memory.
• If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
  
• If or when something is found, click the Yes button when it asks you if you want to cure it.

• Once the short scan has finished, Click Settings > Change Settings
  
• Under the Scanning tab UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
  
• Click Yes to all if it asks if you want to cure/move any file(s).
  
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

* After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
* Copy and paste that log in the next reply

[taydan030109]

doing the complete scan, its stuck on            PC TOOLS anti virus......     it just keeps scanning the same files over and over....  with no other progress   when i look in add/remove programs its not there so now i realy dont know??

[evilfantasy]

I can't remember if you can pause Dr Web or not but it either needs to be paused or stopped to do this.

You need to go in and delete all of these files.

c:\users\corey\appdata\roaming\PC Tools
c:\programdata\PC Tools
c:\program files\PC Tools AntiVirus
c:\program files\PC Tools

You will need to unhide some folders to find them.

How to show hidden files in Windows Vista

To enable the viewing of Hidden files follow these steps:

• Close all programs so that you are at your desktop.
• Open the Control Panel menu and click Folder Options.
  
• After the new window appears select the View tab.
  
• Put a checkmark in the checkbox labeled Display the contents of system folders.
  
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
  
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
  
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
  
• Press the Apply button and then the OK button and exit My Computer.
• Now your computer is configured to show all hidden files.

.
Once we are finished remember to re-hide the hidden files/folders.

[taydan030109]

the only thing i can find and delete is in the roaming.. now i clicked deleted, went to my recycle bin i emptied that.. now wat??

[evilfantasy]

Download the OTMoveIt3 by OldTimer

Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator.

* Save it to your Desktop.
* Double-click OTMoveIt3.exe to run it.
* Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

Code: [Select]

:Processes
explorer.exe

:files
c:\programdata\PC Tools
c:\program files\PC Tools AntiVirus

:Commands
[purity]
[emptytemp]
[start explorer]

* Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
* Click the red Moveit! button.
* Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process.

[taydan030109]

the move it log says its too big to attach it......

[evilfantasy]

That's OK it should have removed the folders and files.