Antivirus.net

• Malware Logs can sometimes take a lot of time to research and interpret.
  
• Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  
• Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  
• PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

• rkill
  
  
  
  • Please download rkill (Courtesy of Bleepingcomputer.com).
  • There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
  • Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
  • Note: You only need to get one of the tools to run, not all of them.
  
  
  1. rkill.exe
  2. rkill.com
  3. rkill.scr
  4. WiNlOgOn.exe
  5. uSeRiNiT.exe
  
  Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.
  
  Run rkill repeatedly until it's able to do it's job. This may take a few tries.
  
  You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.
  
  
• Please perform the following scan
  
  
  
  • Please download DDS from here and save it to your desktop.
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
  • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.
  
  
• Please scan your system with GMER
  
  
  [external image: Posted Image]
  Download GMER Rootkit Scanner from here or here.
  
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and post it in your reply.

• Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
  
• NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
  
• Copy and Paste the text in the quotebox below into the open Notepad window:
  
  

  DDS::
  uInternet Settings,ProxyServer = http=127.0.0.1:8992
  uInternet Settings,ProxyOverride =

  
  
• Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
  
• Close any open browsers.
  
• Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Refering to the picture below, drag CFScript.txt into ComboFix.exe
  
  [external image: Posted Image]
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
• Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
  
  [external image: Posted Image]
  
• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  [external image: Posted Image]
  
• Click on Yes, to continue scanning for malware.
• When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
• Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
• Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

I try double clicking the Combofix Icon, nothing apparent.

• Reboot Your System in Safe Mode with Networking
  
  
  
• Restart your computer.
• As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
• Use the arrow keys to select the Safe Mode with Networking menu item.
• Press Enter.

it would not drag to the desktop

• Please work through the following steps
  
  
  
• Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
• NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
• Copy and Paste the text in the quotebox below into the open Notepad window:
  
  

  DirLook::
  C:\3874fa007b870ccb6c
  
  FileLook::
  ubccvbwsjmo.exe

• Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
• Close any open browsers.
• Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Refering to the picture below, drag CFScript.txt into ComboFix.exe
  
  [external image: Posted Image]
  
  
• When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
• Once the log is produced, re-engage your resident anti virus.

Not a business computer

• Please perform the following scan:
  
  
  
  • Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
  
  
  • Double click on the mbam-setup.exe icon to install the program.
  • Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
  • Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
  • Click on the "Update" tab and then on "Check for Updates".
  • The program will now install the latest Malware definition files.
  • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
  • Once the program has scanned your computer, a log file will be created in Notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  
  
  
  • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
  • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
  • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
  • Come back here to this thread and Paste the log in your next reply.
  
  
• Please un-install J2SE Runtime Environment 5.0 Update 2
  
  
  
  • Click on "Start" then on "Control Panel" and then on "Add or remove programs".
  • Click on "remove a program". A list of currently installed programs will be displayed.
  • Find the "J2SE Runtime Environment 5.0 Update 2" program, click on it once and then click on the "uninstall" button.
  • If you are prompted to re-boot your computer to complete the uninstall please do so.
  
  
• Please update your Java
  
  
  
  • Click on "Start", then on "Control Panel".
  • Go to "Add or Remove Programs" and uninstall any previous versions of Java that you find.
  • Reboot your computer.
  • Next, download the latest version of Java by clicking here
  • Scroll down the page until you reach "Java Platform Standard Edition".
  • Beneath this and to the right, you will see a button marked "Download JRE".
  • Click the "Download JRE" button.
  • Select the platform (Windows, in your case), multi language.
  • Accept the license agreement and click on "Continue".
  • You do not have to register if you do not want to (the registration step is optional).
  • Scroll down and click on the file called jre-6u23-windows-i586.exe located under "Windows Offline Installation".
  • Save the file to your desktop.
  • Do not select Run.
  • Double click on the saved file (jre-6u23-windows-i586.exe) to install the update.
  • Delete the downloaded installation file after completing the above procedure and reboot your system if not prompted to do so.
  
  Please post the MBAM log in your next reply along with a fresh DDS log.

• Please run the following scan
  
  
  
• Note: You will need to use Internet Explorer for this scan.
• Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
• Please disable your real time security programs before performing the scan.

• Scan your system with Eset Online Scanner
• Place a check mark in the box YES, I accept the Terms Of Use.
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
• Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
• Double click on the [external image: Posted Image] icon on your desktop.

• Check [external image: Posted Image]
• Click the [external image: Posted Image] button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option to "Remove Found Threats" is UN checked.
• Push the "Start" button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the [external image: Posted Image] button.
• Push [external image: Posted Image]

• Please work through the following steps
  
  
  
• Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
• NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
• Copy and Paste the text in the quotebox below into the open Notepad window:
  
  

  File::
  C:\Documents and Settings\Owner.YOUR-E3513F081B\Local Settings\Application Data\Mozilla\Firefox\Profiles\x1vu5abw.default\Cache\49F2B1E9d01
  
  SkipFix::

• Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
• Close any open browsers.
• Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Refering to the picture below, drag CFScript.txt into ComboFix.exe
  
  [external image: Posted Image]
  
  
• When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.