Big problem

Java(TM) 6 Update 7 <--- Uninstall this outdated version of Java

What is this seen running at start up?

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

Folder::
C:\Documents and Settings\George\7zSA60.tmp
C:\Documents and Settings\George\7zSA6D.tmp
C:\Documents and Settings\George\7zSA8B.tmp
C:\Documents and Settings\Default User\7zSA60.tmp
C:\Documents and Settings\Default User\7zSA6D.tmp
C:\Documents and Settings\Default User\7zSA8B.tmp
File::
C:\Documents and Settings\George\DelB18.bat
C:\Documents and Settings\George\elB18.tmp
C:\Documents and Settings\George\GLBA4F.tmp
C:\Documents and Settings\Default User\DelB18.bat
C:\Documents and Settings\Default User\DelB18.tmp
C:\Documents and Settings\Default User\GLBA4F.tmp

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

Go to TDSSKiller and Download TDSSKiller.zip to your Desktop

• Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
• Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor.
• Allow the application to run and a window will open showing that it is TDSSkiller from Kaspersky
• Click Start scan
• It will run rather quickly and will notify you of whether anything is found or not.
• Follow the instructions to delete/quarantine if asks you what to do when if finds something.

Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

Reboot the machine again.

Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some data on it
• Right click on the screen and select > Select All
• Press Control+C
• Open a notepad and press Control+V
• now please ATTACH that report to this thread

You need to install some antivirus when we are finished here, but not until.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now!

 

This sounds more like a windows issue than a malware issue. However, let's have you try doing an online scan:

eSet Online Scan.

 

Are you running all of the computers through a router? If so, you need to find the recessed red button on the back or bottom and press it in for a few seconds. If you had any special configurations to the router, you will need to reset them. Tell me if that changes anything.

You can also test this by by-passing the router and connecting directly to the modem. If the issue stops, it is the router that is infected.

 

Since we were not seeing any malware in your logs, I have asked Chaslang to have a second look at your thread.

 

See if you can use CCleaner to check for programs in your add/remove folder. You may need to post in the software forum to get help in repairing your add/remove items.

 

You may need to do a repair install. Worst case would be to backup all your personal files and data and do a reformat and clean install.

 

Correct! It is not malware, it is just related to the programs being used on your PC. We have seen this before and sometimes it had to do with Wireless Interfaces. Either way, it is not malware and not a topic for this forum.

The fact that Add/Remove Programs does not display is also not likely to be malware. Sometimes antivirus programs have been know to cause extreme delay in see Add/Remove Programs populate. There are also cases where it may just be a problem within Windows. See this:http://support.microsoft.com/kb/266668/en-us


For file and or registry permissions issues, the below should have been run:

Resetting Registry and File Permissions

 

Good to know you are back up and running well. Safe surfing.