Can't shift XP Shield

Just to let you know we are currently reviewing your logs and will get back to you as soon as we work out a plan of action

Thanks
Kes13!

 

Hi GRL570810

1) Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

2) Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix exit HJT.


3) Now we need to use combofix to removae a bunch of malware files

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
• If it is not on your Desktop, the below will not work.

Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

4) Now install and Run Ccleaner! available from the below link

Ccleaner Slim

• Now run Ccleaner with the default options (that means don’t change anything) to clean out temporary files.
• Only use the default settings on the Windows Tab and select Run Cleaner. Do not run any other options from other tabs.
• Also it is highly recommended to login to all other User Accounts on the PC including the Administrator account (on Win2K,XP and Vista) which will only show when you boot in safe mode.
• Run CCleaner on each account. This can greatly reduce scan time and log sizes from the later scanning you will do below.
• If you don’t see Ccleaner’s link when logging into the other accounts, just goto the C:\Program Files\Ccleaner folder and double click on the ccleaner.exe file to run it. You can also create a shortcut to the file on the Desktop of your other user accounts to make it easier to run in the future.
• If you booted into safe mode to clean the Adminstrator account, be sure to reboot in normal mode before continue on with the below instructions.

5) Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

taking a look at your logs, I will be back later on this evening.

Thanks
Kes

 

Hi

1) Please disable Windows Messenger, you have not yet done this, follow the instructions for doing so in post #4

2) What can you tell me about this file below?

C:\Program Files\Windows Media Player\Sample Playlists\lanbv.dll

Thanks
Kes13!