[docho]

Hello,

I'm running Windows XP SP2.
Lately i've notived i cannot access any microsoft related sites, and after trying to follow the instructions on this post -
http://forums.techguy.org/malware-re...-websites.html
i've discovered i cannot access any online virus scanning sites (including bitdefender as suggesed in that post).

I'm also having a problem which causes my router to disconnect from the internet everytime i try to upload an email attachment, which i don't know if it has anything to do with the previous problem.

I'll be glad for some help.

Thank you very much!

Here's my current HijackThis log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:18:38, on 26/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Ad-Aware\aawservice.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: מחקר - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {42FDC231-A411-45F8-B8B6-3B5026111DA8} (SolitaireRush Control) - http://www.worldwinner.com/games/v47...itairerush.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v51.../bejeweled.cab
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - http://www.worldwinner.com/games/v56...rsolitaire.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41...l/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinner.com/games/v67/swapit/swapit.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: fccdbcd - fccdbcd.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 5276 bytes

[NeonFx]

Hello there Welcome to the Tech Support Guy forums.
My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me.

Please note the following:

• The fixes are specific to your problem and should only be used on this machine.
• Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not necessarily mean that the system is completely clean.
• It's often worth reading through these instructions and printing them for ease of reference. I may ask you to boot into Safe Mode where you will be unable to follow my instructions online.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Step 1

Download OTS to your Desktop

• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program.
• Check the box that says Scan All Users
• Under Additional Scans check the following:
  
  • Reg - Desktop Components
  • Reg - Disabled MS Config Items
  • Reg - NetSvcs
  • Reg - Shell Spawning
  • Reg - Uninstall List
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EvtViewer (last 10)
  
  
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post. To do so click on the blue "Reply" button or "Go Advanced" and click on the "Manage Attachments" button

To ensure that I get all the information this log will need to be attached. If it is too large to attach then upload it to Mediafire and post the sharing link.

Step 2

Download RootRepeal from one of the following locations and save it to your desktop:

Link 1
Link 2
Link 3

• Double click to start the program
• Click on the Report tab at the bottom of the program window
• Click the button
• In the Select Scan dialog, check:
  
  • Drivers
  • Files
  • Processes
  • SSDT
  • Stealth Objects
  • Hidden Services
  • Shadow SSDT
  
  
• Click the OK button
• In the next dialog, select all drives showing
• Click OK to start the scan

  Note: The scan can take some time. DO NOT run any other programs while the scan is running
  

• When the scan is complete, click the button and save the report to your Desktop as RootRepeal.txt
• Go to File, then Exit to close the program

If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.

[docho]

Hello NeonFx,

First of all, thank you very much for your help!

I've attache the 2 reports as you've instructed.
Regarding Rootrepeal, i only wanted you to know that everytime i run RootRepeal i get an error message saying "Error - invalid PE image found!" but i just pass it and can use the program.

Thank you!

[NeonFx]

Before we get to the fixing ( I can already see the bad file ) Is this a company computer? I ask because I try to not get in the way of Company IT departments and probably shouldn't work on a system that doesn't entirely belong to the current user.

Also, Did you set up the Proxy to point to 193.63.58.71 ? (if you don't know what that means then the answer is probably No, unless you had someone else set your computer up for you. A proxy is a way of tunneling all of your internet traffic through another computer/server before it reaches the internet)

[docho]

Hi again,

This is not a company computer.
It's a private pc and i'm its only user.

I did set up the proxy to point to that address which i've found to be a free public proxy server, although it should be disabled now. I've done it as a way to try and bypass this virus not letting me get into certain websites (microsoft and antivirus) and it actually partly worked even though i still couldn't run any online virus scans.

Thanks!

[NeonFx]

Alright. Let's get to it then

STEP 1

You have an infected external drive or two.

Download Flash_Disinfector.exe by sUBs from here and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder...it will help protect your drives from future infection.



STEP 2

Run OTS

• Under the Paste Fix Here box on the right, paste in the following
  
  

  [Unregister Dlls]
  [Registry - Safe List]
  < Internet Explorer Settings [HKEY_USERS\S-1-5-21-1757981266-1957994488-1060284298-1003\] > -> 
  YN -> HKEY_USERS\S-1-5-21-1757981266-1957994488-1060284298-1003\: "ProxyServer" -> 193.63.58.71:3128
  < FireFox Settings [Prefs.js] > -> C:\Documents and Settings\itzhaki\Application Data\Mozilla\FireFox\Profiles\yg7rnpsb.default\prefs.js
  YN -> network.proxy.autoconfig_url -> "http://www.bgu.ac.il/bgu.pac"
  YN -> network.proxy.backup.ftp -> "194.36.10.154"
  YN -> network.proxy.backup.ftp_port -> 3127
  YN -> network.proxy.backup.gopher -> "194.36.10.154"
  YN -> network.proxy.backup.gopher_port -> 3127
  YN -> network.proxy.backup.socks -> "194.36.10.154"
  YN -> network.proxy.backup.socks_port -> 3127
  YN -> network.proxy.backup.ssl -> "194.36.10.154"
  YN -> network.proxy.backup.ssl_port -> 3127
  YN -> network.proxy.ftp -> "193.63.58.71"
  YN -> network.proxy.ftp_port -> 3128
  YN -> network.proxy.gopher -> "193.63.58.71"
  YN -> network.proxy.gopher_port -> 3128
  YN -> network.proxy.http -> "193.63.58.71"
  YN -> network.proxy.http_port -> 3128
  YN -> network.proxy.share_proxy_settings -> true
  YN -> network.proxy.socks -> "193.63.58.71"
  YN -> network.proxy.socks_port -> 3128
  YN -> network.proxy.ssl -> "193.63.58.71"
  YN -> network.proxy.ssl_port -> 3128
  < Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  YN -> "CTFMON.EXE" -> C:\WINDOWS\System32\ctfmon.exe [C:\WINDOWS\system32\ctfmon.exe]
  < Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  YN -> "CTFMON.EXE" -> C:\WINDOWS\System32\ctfmon.exe [C:\WINDOWS\system32\ctfmon.exe]
  < Run [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  YN -> "CTFMON.EXE" -> C:\WINDOWS\System32\CTFMON.EXE [C:\WINDOWS\system32\CTFMON.EXE]
  < WinNT Load [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
  *load* -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
  YY -> C:\WINDOWS\system32\opnkj.exe -> C:\WINDOWS\System32\opnkj.exe
  < WinNT Load [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
  < WinNT Load [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
  *load* -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
  YY -> C:\WINDOWS\system32\opnkj.exe -> C:\WINDOWS\System32\opnkj.exe
  < WinNT Load [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
  < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
  *AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
  YN -> karna.dat -> 
  < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
  < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
  YN -> fccdbcd -> 
  < ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
  YN -> "{CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134}" [HKLM] -> Reg Error: Key error. []
  < LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages
  *LSA Authentication Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages
  YN -> C:\WINDOWS\system32\opnkj -> 
  < LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages
  < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
  YN -> \{056262a1-5f17-11de-aeed-000cf116a74b} -> 
  YN -> \{056262a2-5f17-11de-aeed-000cf116a74b} -> 
  YN -> \{1ec28cd4-d99f-11dc-ab39-000cf116a74b} -> 
  YN -> \{1ec28cd4-d99f-11dc-ab39-000cf116a74b} -> 
  YN -> \{1ec28cd4-d99f-11dc-ab39-000cf116a74b} -> 
  YN -> \{47bf6fd0-b4fc-11de-afac-000cf116a74b} -> 
  YN -> \{47bf6fd1-b4fc-11de-afac-000cf116a74b} -> 
  YN -> \{516b7510-05e2-11de-ae03-000cf116a74b} -> 
  YN -> \{516b7510-05e2-11de-ae03-000cf116a74b} -> 
  YN -> \{64a38b80-9718-11de-af67-000cf116a74b} -> 
  YN -> \{92388820-85a2-11de-af4a-000cf116a74b} -> 
  YN -> \{92388821-85a2-11de-af4a-000cf116a74b} -> 
  YN -> \{b1d8f872-ac0b-11de-af9c-000cf116a74b} -> 
  YN -> \{bca1fe30-0fb5-11de-ae20-000cf116a74b} -> 
  YN -> \{bca1fe31-0fb5-11de-ae20-000cf116a74b} -> 
  YN -> \{de608c30-ab6a-11de-af9b-000cf116a74b} -> 
  [Registry - Additional Scans - Safe List]
  < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost > -> 
  *netsvcs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs
  YY -> mmvnerz -> C:\WINDOWS\System32\bqbzmxz.dll [C:\WINDOWS\System32\bqbzmxz.dll]
  < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost > -> 
  [Empty Temp Folders]
  [Reboot]
  

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• This will create a log in C:\_OTS\MovedFiles\<date>_<time>.txt where date and time are those of when the fix was run. Open it from there if it does not appear automatically on reboot. Please copy and paste or attach the contents of that file here.

STEP 3


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Disabling Security Programs
• Double click on ComboFix.exe & follow the prompts.
  
  Note: Combofix will run without the Recovery Console installed.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you please let me know. A increasing number of infections are spreading using Autoplay and leaving it disabled is a good idea.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



STEP 4

Run OTS again and click on the Quick Scan button at the top. Copy and Paste or attach the results of this scan in your next reply.

[docho]

Hey NeonFx,

I've completed all the steps and can already access blocked sites again.
So first of all - thank you very much!

I've attached all the reports as you requested.
I'm waiting to hear if there's any other things i need to do to clean up my computer and would also appreciate it if you could advice me of a good and free antivirus/antimalware program that i should install in order to prevent my pc from getting infected again.

Thanks!

[NeonFx]

Alright

STEP 1

This is a good time to get an AntiVirus program running.

Please choose one of the following free AntiVirus programs: Avast! AVG AntiVir and install it. See HERE for a quick and easy comparison of the three.

STEP 2

Please do the following:

1. Close any open open programs before running the fix.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the quotebox below into it:

File::
c:\recycler\S-1-5-21-1254416572-1263425100-317347820-0350\system.exe

FCopy::
c:\windows\system32\dllcache\ctfmon.exe | c:\windows\system32\ctfmon.exe

SRPeek::
c:\windows\system32\drivers\beep.sys

Mia::
c:\windows\system32\drivers\beep.sys

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTF Loader"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{99ESP9C2-4FED-15CF-AAE5-62CB5F2X4512}]

DDS::
uInternet Settings,ProxyServer = 193.63.58.71:3128

NOTE: Make sure WordWrap is unchecked in Notepad by clicking on the "Format" menu icon.

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.


STEP 3

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan. Scan all of your harddrives.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

[docho]

Hello again,

Sorry it took me sometime to post this, since i wasn't home for a few days.
I've attached the reports.

Thanks!

[NeonFx]

I was unable to find a backup of a file that your computer is missing so please download it from HERE. Then unzip the archive and save/transfer the contents (beep.sys) to the following folder:

c:\windows\system32\drivers\

If you need help doing that let me know.

Then please run ComboFix again by double clicking on it.

[docho]

I copied the file and attached the new report.

Thanks!

[NeonFx]

Good job Let's run an online scan to make absolutely sure you're clean. This will take a while but it's well worth it as it can often find things all other scanners will miss.

STEP 1

The online scanner uses Java, so I will need you to download and install the latest version for that.

Please go here to download the installer:

http://java.com/en/download/index.jsp


STEP 2

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.



2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.


The program will then begin downloading and installing and will also update the database.


Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report... at the bottom.
• Click the Save report... button.
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

[docho]

Hey again!
I've attache the kaspersky report...

[NeonFx]

Excellent. How's the computer running now?

[docho]

Everything is working great!
Thank you soooo much for your great help!
I really appreciate it!