[Closed] spyware infection i'm stumped

hello, this is my first post i've stumbled upon this site while trying to find out what is wrong with my girlfriends computer and need help. right now i'm just going to describe the problem because i'm not totally sure about everything i need to attach to this post to possibly get some help. my desktop background changed and said warning you have a spyware infection. everything else works on my computer but when we tried to log into her online banking we were redirected to a site to register for a visa card. we contacted the bank and they informed us that they didn't have anything like this and that we needed to find out if our computer was infected and until then they would suspend the online account so nothing could get into it and mess around with her stuff. i don't really know about the best spyware/antivirus software but i ran her avg antivirus in safemode and it found a lot of infections and said it got rid of them. her background picture has changed back and her computer isn't slowing up anymore. but we are redirected from google searches and again the same problem with the banking any help would be greatly appreciated as we are unable to access her billing information and other pay services that she uses over the online account. thanks a lot again!

Hi and Welcome,

NOTE:

• Malware removal is NOT instantaneous, most infections require more than one round to properly eradicate.
• Absence of symptoms does not always mean the job is complete, you can be certain that I will advise you when the computer is clean.
• Kindly follow my instructions in the order posted.
• Please DO NOT run any scans or fix items without my direction.

Please do the following:

STEP #1

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries




.

here are the two files for step 1

I've tried to complete step 2, but I have GMER on my desktop, extrated the files, and tried to run it, but each time it doesn't run and I get an error that the application has to close and to send the error report.

Please try it in safemode

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY repeatedly,
• this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode
• Then press the Enter Key on your Keyboard
• go into your usual account

I tried to run both download options for step two in normal mode and safe mode. Neither would run in either setting.

Ok,

Skip that step for now then.

Please do the following:

Download Combofix from any of the links below. You must rename it before saving it.
Save it to your desktop.

**Note:  In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

Link 1
Link 2
Link 3


During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–

• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

• Double click on Combo-Fix.exe & follow the prompts.
  
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" for further review.
  **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
  
  
  

  ———————————————————–

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  ———————————————————–

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log