Malware/Spyware? [Solved]

Below is my HijackThis log. I'm using Windows XP with SP3. Problem one: When I boot up, there is no problem other than a Rundll error box that comes up in the center of the desktop. It reads. "Rundll. Error loading C:\Program Files\Common Files\DXSurface\DXSurfaceModifier.dll. If I click the X in the corner of this error box, it goes away and doesn't seem to cause any problems—unless this has something to do with my PC running very slow. For example, when I click the Yahoo icon on the desktop, it takes up to a couple minutes to get to Yahoo. From the Yahoo homepage, when I click the Facebook link, it takes several minutes to get to Facebook. For a few weeks, it doesn't go directly to Facebook, but is redirected to a sight that has nothing to do with FB. Usually if I click the X in the upper right corner that will take me back to Facebook, but it still takes a minute or two for FB to load.

Another example is when I tried to download HiJackThis from Cnet.com. It took several minutes to get anywhere, but was redirected to another sight. I clicked the X in the corner and that got me back to CNET.com.

I have cleared the temp files, etc., but that doesn't help. I use AVG Free and SpyBot S&D. One did find a trojan which was supposedly taken out, but that has not helped.

A few years ago the same thing happened with another PC and HijackThis was the only thing that solved the problem, so I'm hoping it will help this time.

————————————————————–
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:11:09 PM, on 5/9/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DXSurfaceModifier] rundll32.exe "C:\Program Files\Common Files\DXSurface\DXSurfaceModifier.dll",wmain
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{349877E2-08A5-4885-9F71-527556531BD9}: NameServer = 216.220.230.24 216.220.230.25
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 5806 bytes

Here's the DDS log. I didn't know how to get this and aswMBR logs on the same page, so will send the aswMBR as soon as I send this.. —————————————————– DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by [removed] at 19:21:31 on 2012-05-10 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.121 [GMT -4:00] . AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\LSI SoftModem\agrsmsvc.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe \\.\globalroot\SystemRoot\system32\svchost.exe -k netsvcs C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE . ============== Pseudo HJT Report =============== . mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [DXSurfaceModifier] rundll32.exe "c:\program files\common files\dxsurface\DXSurfaceModifier.dll",wmain dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: mswsock.dll DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: Interfaces\{096432F2-C5DF-44D4-9468-50621E63D465} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{349877E2-08A5-4885-9F71-527556531BD9} : NameServer = 216.220.230.24 216.220.230.25 TCP: Interfaces\{584143A7-4CD7-46EB-BD26-85CFF198F796} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{84609D5E-81A5-41C8-8806-1EF8A04F65EA} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{C5A035C7-695D-4983-BBA9-6A9C6AB9D97A} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{F9E322F8-784A-4FDE-94B6-012C9B02C12D} : DhcpNameServer = 192.168.2.1 Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: avgrsstarter - avgrsstx.dll Notify: LMIinit - LMIinit.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll Hosts: 127.0.0.1 www.spywareinfo.com . ============= SERVICES / DRIVERS =============== . R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-24 335240] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-24 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-24 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-11-3 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-11-3 297752] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\x86\rainfo.sys [2008-4-1 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-4-1 47640] S2 ALIEHCD;ALi PCI to USB Enhanced Host Controller;c:\windows\system32\drivers\AliEhci.sys [2009-9-5 112835] S2 avgfwsrv;CBN;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 axinstsv;Nbf;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 cpuz132;Spupdsvc;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 fsssvc;MSSQL$AUTODESKVAULT;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 ikfileflt;Msloop;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 ikfilesec;DCamUSBDXGTech;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 ikhlayer;Sscdbhk5;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 klif;Rrrspy;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 mcafeeantispyware;Point32;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 mcproxy;Smartwiservice;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 mcrdsvc;Mcstrm;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 mcusrmgr;V2imount;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 pavfnsvr;W810mdfl;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 pavsrv;Rnadirmultiplexor;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 savscan;BrPar;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\scutum50.sys –> c:\windows\system32\drivers\Scutum50.sys [?] S2 Slpsvdr;Rpaservice;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S2 ZY202_XP;Bdpredir;c:\windows\system32\svchost.exe -k netsvcs [2001-8-18 14336] S3 alihub;Generic Hub on USB 2.0 Bus;c:\windows\system32\drivers\AliHub.sys [2009-9-5 17823] S3 aliroothub;USB 2.0 Root Hub;c:\windows\system32\drivers\AliRtHub.sys [2009-9-5 5325] S3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver;c:\windows\system32\drivers\m4301A.sys [2009-11-3 83552] S3 MOSUMAC;USB-Ethernet Driver;c:\windows\system32\drivers\MOSUMAC.SYS [2010-12-27 40448] S3 VNUWL5B;VIA Networking Technologies USB Wireless LAN Adapter Driver Service;c:\windows\system32\drivers\VNUWL5B.SYS [2010-9-24 145408] S4 LMIRfsClientNP;LMIRfsClientNP; [x] S4 vsdatant;vsdatant;a –> a [?] . =============== Created Last 30 ================ . 2012-05-10 01:53:35 388096 —-a-r- c:\documents and settings\jerry\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2012-05-10 01:53:33 ——– d—–w- c:\program files\Trend Micro 2012-05-04 01:15:01 ——– d—–w- c:\documents and settings\all users\application data\IObit 2012-04-26 22:15:59 ——– d—–w- c:\program files\Spybot - Search & Destroy 2012-04-26 22:15:59 ——– d—–w- c:\documents and settings\all users\application data\Spybot - Search & Destroy 2012-04-26 18:29:22 ——– d—–w- C:\SpyBot 2012-04-21 04:57:23 ——– d—–w- c:\documents and settings\jerry\application data\Malwarebytes 2012-04-21 04:56:46 ——– d—–w- c:\documents and settings\all users\application data\Malwarebytes 2012-04-19 15:42:12 0 –sha-w- c:\windows\system32\dds_trash_log.cmd 2012-04-19 15:38:05 ——– d—–w- c:\program files\common files\DXSurface 2012-04-19 15:37:59 ——– d—–w- c:\documents and settings\all users\application data\529C5063000166F200015441D151FC4E . ==================== Find3M ==================== . 2012-03-01 11:01:32 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01:32 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01:32 1469440 ——w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10:16 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 14:10:16 148480 —-a-w- c:\windows\system32\imagehlp.dll 2012-02-29 12:17:40 385024 —-a-w- c:\windows\system32\html.iec . ============= FINISH: 19:23:32.21 ===============

Hi jwr243

Thanks for the logs. Attach.txt was missing but we may not need that.

You have a very serious infection on your computer that can be very difficult to remove at times so let’s get started and see what we can do.

Run TDSSKiller

Please download TDSSKiller.zip

• extract it to your desktop
• double click TDSSKiller.exe
• press Start Scan
  
  • only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
  • then click Continue > Reboot now
• copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• see this Link for programs that need to be disabled and instruction on how to disable them.
• remember to re-enable them when we're done.
• double click on ComboFix.exe & follow the prompts.
  
• as part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
  
  

  [external image: Posted Image]

  
  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  

  [external image: Posted Image]

  
  Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Please also remember to include the TDSSKiller log

Thanks

Satchfan

jwr243

Before we carry on, please let me reasure you that many people who ask for help at this, (and other forums), don't understand some of the instructions and need a bit of guidance, so don't be afraid to ask for clarification.

Should the Attach.txt file have been with the DDS log?

Don't concern yourself about that because we don't need it at the moment.

I have TDSSkiller and Combo Fix saved on my desktop, but didn't have AVG 8 or HijackThis disabled when I downloaded them. Is it only necessary to disable these when running the scan?

HijackThis can be totally ignored so you don't have to worry about that.

AVG must be disabled before running ComboFix.

Open the AVG 8 Control Center, by right-clicking on the AVG 8 icon on task bar.

• click on Tools
• select Advanced
• in the left hand pane, scroll down to "Resident Shield".
• in the main pane, deselect the option to "Enable Resident Shield."
• to re-enable AVG 8, please select "Enable Resident Shield" again.

Please then run both TDSSKiller and ComboFix

If you are still unsure about anything, please let me know.

Satchfan

How do I extract theTDSSKiller tool to the desktop? I have an icon for TDSSKIller on the desktop, but nothing happens when I click it. If I left click the mouse on the TDSSKiller icon, a "Compressed (zipped) Folders Error box pops up that reads. "The Compressed (zipped) Folder Is Invalid or Corrupted." I right clicked the mouse and chose Extract All… This went to the Extraction Wizard. When I clicked "Next" the Wizard asks me to Select a Destination. When that is done and I click "Next", another Compressed (zipped) Folders Error box popss up that states, "No Files To Extract." The empty prgress line box is at the bottom of the box an states it is extracting. but nothing happens. I waited 15 minutes and there was no indication anything was extracting. What am I doing wrong. I downloaded TDSSKiller a second time and the same thing happened.

What am I doing wrong

You are doing nothing wrong. Some files are "zipped" to make them smaller and have to be "extracted".

To avoid having to do this, use the link here. This is already "unzipped".

Then try running both TDSSKiller and ComboFix

Thanks

Satchfan

That worked and TDSSKiller found 5 threats. There is a box at the right of each threat name. Four have "Delete" and one has "Cure". Should I leave them as they are and click continue?

I don't have the log because I didn't click "continue". I wasn't sure if I was suppose to do that, so I left the TDSSKiller page and wrote to ask you. That first scan found 5 threats. Then I re-enabled AVG 8.5 and shut down my PC because I had to out for awhile. When I turned my PC back on a few minutes ago, I found your reply, telliing me to send the log, but as I explained, I don't have it. Forgetting to disable AVG 8.5 this time, I ran another scan and this time it found no threats. I disabled AVG and scanned again with the same results, no threats found. At the bottom right of the results box the "Continue" button wasn't there, just a "close" button. I presume this is because no tthreats were found with this scan. Why were 5 threats found with the first scan, but none on the next two? On the results box there is "Report" at the upper right and in the box itself is: Processed: 684 objects, details. When I click either "Report" or "details", a list of items comes up. Each list is different. Is one of these the log? If so, I how do I send it? I can't highlight either of them, and when I click the mouse over either of them, nothing happens. Usually when the mouse is clicked a menu comes up, but that doesn't happen here. I haven't run ComboFix yet because I'm trying to get TDSSKiller figured out first.

Hi jwr243

Don't worry about ComboFix at the moment; we'll just try to get the other log first,

I don't have the log because I didn't click "continue"

The log should have been saved whether or not you gave the instruction to "Continue".

Please have a look and see if you can locate it. The TDSSKiller report should be found in your root directory, (usually C:\) called TDSSKiller_*** (*** will be the version & the date it was run).

If you can't find it, don't worry, just let me know.

Satchfan