XP Security Tool 2010 Virus Hijacked PC

When you are ready, please attach the requested logs:
SAS
MBAM
ComboFix
C:\MGLogs.zip --> from running the C:\MGTools.exe.

 

Just wait until you have all the logs to attach. It shouldn't take long to get them done.

 

Just to keep you going until Tim signs in.

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode

Uninstall the below outdated java but leave 6.22 alone.

• Java(TM) 6 Update 5
• J2SE Runtime Environment 5.0 Update 9

Open up the Malware Bytes program, locate the update tab > let it update > re-scan > fix all it finds and attach the log regardless.

If you did not deliberately set this proxy yourself then please include it in the HJT fix below:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix exit HJT.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

File::
c:\windows\system32\ls_vbzl.exe
c:\windows\Cgufinet.bin
c:\windows\system32\abhuc.exe
c:\documents and settings\Authorized User\Application Data\sdfsdfgdsfgh.bat
c:\documents and settings\Authorized User\Application Data\hgksfg.bat
c:\windows\Oqotexejivanoqiq.dat
DirLook::
c:\windows\system32\2030
Folder::
c:\documents and settings\All Users\Application Data\kGoEp02039
c:\documents and settings\All Users\Application Data\WSTB

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some data on it
• Right click on the screen and select > Select All
• Press Control+C
• Open a notepad and press Control+V
• now please ATTACH that report to this thread

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and attach all of the other requested logs.

Tell us how things are running for you now.