[Resolved] Malware/Trojans crippling PC

I would like you to run Dr Web again but this time a full scan. The instructions have been reworked ( ta Catbyte ) this will ensure that the full scan is done

Download Dr.Web CureIt to the desktop:

• Doubleclick the drweb-cureit icon to start the program.
• press start
• Allow the program to run the initial express scan
• This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
  Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
  
• Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
• Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take several hours)
• During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
  • Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
• Once the scan is complete, on the menu bar, click file and choose report list.
• Save the report to your desktop. The report will be called DrWeb.csv
• Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
• Close Dr.Web Cureit.
• Please post the Dr.Web.txt report in your next reply

Will do. I'll run it as soon as I return from work (5:15-ish EST).

Ran Express Scan. Found 1 virus "sdcmon.dll. I select the file under 'object'. When I click "CURE" I get these options: Delete Incurable Rename Incurable Move Incurable I don't get a "YES" option at this stage. Should I select "Delete"?

Delete that please

could you then run MBAM at the moment I can see no reason for the lack of connection

Also could you remove the following from Hijackthis and reboot then check your connection again

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local


Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

I should hold off on the full scan w/ Dr. Web Cureit and runn MBAM instead?

My apologies I thought you had completed the scan Yes run the full scan as I would like it to catch all it can

If during the full scan it asks me do I want to MOVE a file, should I? Or should I click "NO"?

Select yes to cure or delete unless you see the word Virut then come back

I get a pop up that says: Archive Contains Infected Objects Move? And my options are: "YES" "YES TO ALL" "NO" and "NO TO ALL"

I click "YES TO ALL"?

Okay, Complete Scan did not finish. Got 3/4 through and I got a blue screen: A problem has been detected and windows has been shut down to prevent damage to your computer. MEMORY_MANAGEMENT Technical Information: STOP: 0x0000001A (0x00041284, 0x04D4F001, 0x000128E8, 0xC0883000) Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group for further assisstance. What you think? Should I start up and run MBAM or make a new HJT log?

Yes run MBAM but prior to that fix this entry in Hijackthis and let me know if you get a connection back. The stop error appears to be related to memory management

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Hello again. Okay, how to i fix that entry in Hijackthis? I've only run scans so far. What do I click?

Run Hijackthis that you already have and place a tick to the left of the following item and select Fix Checked

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Done. Still no connection. Should I run MBAM now?