I was trying to download a song and instead must have ended up with a virus of some sort. Started off with black screen and then the popup messages then warnings and scans. All files were hidden couldn't bring up task manager. I did run combofix which unhide my files and now task manager works. I noticed an unknown file in my C: named 32788R22FWJFW how do I rid this mess?
My name is Richard and I'll be happy to help you with your computer problems.
Please be advised that I am currently in training, so my responses will need to be approved by one of our experts before I post them. This is only to ensure you are receiving accurate instructions. It may cause a delay in my replies.
Please note the following:
The cleaning process is not instant as logs can take time to research. Sit tight and please be patient.
I will be working on your malware issues. This may or may not solve other issues you may have with your system.
While we are fixing your problems, do NOT install/re-install any programs or run any fixes or scanners unless told to do so.
Ensure that your anti-virus definitions are up-to-date.
I would advise backing up all your important documents, personal data files and photos to a CD or DVD drive.
Do not back up any Applications (programs). These should be re-installed from the original source CD(s) or website(s).
During the course of our cleanup, please do not do any additional online work or surfing until we have verified that your system is clean.
I suggest printing out each set of instructions and reading the entire post before proceeding. It will make following them easier.
Be sure to follow the directions and run tools/scans in the order listed.
If you do not reply to your topic, it will be closed after 3 days.
I will return as soon as possible with more instructions.
ComboFix is a very powerful tool. It is not recommended to run ComboFix without expert supervision.
If a ComboFix log was produced, please post that.
ComboFix logs are located at c:\ComboFix.txt, while older logs are at c:\Qoobox\ComboFix2.txt, c:\Qoobox\ComboFix3.txt, etc.
Next
Download DDS by sUBs to your desktop.
Disable any script blocker/antivirus software temporarily.
Double click DDS.scr to run it and wait for the scan to finish
When finished DDS.txt will open
At the next prompt, press Yes
DDS will continue scanning
When done, Attach.txt will open
Save both reports to your Desktop.
Please post the contents of the logs in your next reply.
Next
GMER Rootkit Scanner
—————
Download GMER Rootkit Scanner from here to to your Desktop. It will be a randomly named executable.
Double click the exe file. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
In the right panel, you will see several boxes that have been checked. uncheck the following:
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your Desktop, and attach it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Heres the Gmer, again I did a file search for the combofix and nothing, I know it did something because it unhid my files, however I don't think I downloaded the program to my computer, I don't know if that matters or not.
Please delete your copy of ComboFix.exe and then download a fresh copy of ComboFix:
COMBOFIX
—————
Please download ComboFix from one of the following locations:
Location #1
Location #2 ***IMPORTANT!!! Save the file as Sheriff.exe to your Desktop. It is important you rename ComboFix during the download, but not after. In the event that you already have ComboFix, this is a new version that I need you to download.
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Sheriff.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a Congratulations!!! message.
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\Sheriff.txt in your next reply.
WARNING:ComboFix will disconnect your machine from the Internet as soon as it starts.
Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
If there is no internet connection after running ComboFix, then restart your computer to restore back your connection.
Please do not update the computer at this time, but could you let me know why it has not been updated to Service Pack 3?
I recommend keeping internet use to a minimum while we work together to reduce the risk of further infection which can worsen the state of the computer.
Next
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
Double-click the SystemLook and copy/paste the following into the box:
PC is running, all the programs came back a little slow on the net. Am I suppose to have the service pack 3? I try really hard not to download anything when updates say they need updated, seems I get too much junk with it. Let me know if I need to get the service pack. Thanks
Please do not update the computer at this time. I will tell you when it is safe to update.
It is very important that you install all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and IE up to date will help make you less susceptible to future malware infections.
Before we start: The following steps involve modifying the registry. Modifying the registry can be dangerous (and can render your system unbootable) so it's advisable that you make a backup of the registry before proceeding.
For version with the Installer: Use the setup program to install ERUNT on your computer.
For the zipped version: Unzip all the files into a folder of your choice.
Run Erunt.exe to backup your registry to the folder of your choice.
Note: To restore your registry, go to the folder and start ERDNT.exe
Next
Please download OTM by OldTimer.
Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
