Fake Antivirus

No, I can't delete them. I'm guessing they're just remnants left over, but it won't let me remove them. Screenshot is attached, but cut off the empty side of the desktop to make it smaller.

Ok let's try to get rid it using OTL, but I first need to make sure the correct path. Download OTL first and don't use it just yet.

Download here : http://forums.whatthetech.com/index.php?au…nload&id=19

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  *HijackThis*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook 04.09.10 by jpshortstuff Log created at 09:50 on 17/01/2011 by Amanda Administrator - Elevation successful ========== filefind ========== Searching for "*HijackThis*" C:\Users\Amanda\Desktop\HiJackThis.exe –a—- 388608 bytes [15:21 12/01/2011] [15:21 12/01/2011] (Unable to calculate MD5) C:\Users\Amanda\Desktop\HiJackThis2.exe –a—- 388608 bytes [15:22 12/01/2011] [15:22 12/01/2011] (Unable to calculate MD5) -= EOF =-

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Files
  C:\Users\Amanda\Desktop\HiJackThis.exe
  C:\Users\Amanda\Desktop\HiJackThis2.exe
  C:\Users\Amanda\Desktop\6zhswmis.exe
  C:\Users\Amanda\Desktop\mltptn5b.exe
  C:\Users\Amanda\Desktop\7wresv87.exe
  
  :Commands
  [emptyflash]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

The icons are gone now! All processes killed ========== FILES ========== C:\Users\Amanda\Desktop\HiJackThis.exe moved successfully. C:\Users\Amanda\Desktop\HiJackThis2.exe moved successfully. C:\Users\Amanda\Desktop\6zhswmis.exe moved successfully. C:\Users\Amanda\Desktop\mltptn5b.exe moved successfully. C:\Users\Amanda\Desktop\7wresv87.exe moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Amanda ->Flash cache emptied: 405 bytes User: Default User: Default User User: Public Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Amanda ->Temp folder emptied: 127281 bytes ->Temporary Internet Files folder emptied: 677291540 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 49189039 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 10965276 bytes Total Files Cleaned = 703.00 mb OTL by OldTimer - Version 3.2.20.2 log created on 01172011_095705 Files\Folders moved on Reboot… File\Folder C:\Windows\temp\mcafee_987WrwmXsBpVQy8 not found! File\Folder C:\Windows\temp\mcmsc_gfSubDRnZdksTQY not found! File\Folder C:\Windows\temp\mcmsc_iHcCbsL5OmAna0s not found! File\Folder C:\Windows\temp\mcmsc_OBpPMyo2RcI05fE not found! C:\Windows\temp\sqlite_cRnvYMHVjkBdi3X moved successfully. C:\Windows\temp\sqlite_YdxFDspjesbgfBT moved successfully. File\Folder C:\Windows\temp\WFV6BBC.tmp not found! Registry entries deleted on Reboot…

Good to hear that. Anymore outstanding issues that I may help?

Nope, that's it. Thank you so much for your help and patience!

You're welcome Remember to do cleanup for OTL.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.