combofix deleted system files

You will need to follow all the instructions here:

READ & RUN ME FIRST. Malware Removal Guide

In the meantime,

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

DeQuarantine::
C:\Qoobox\Quarantine\C\Documents and Settings\Admin\rundll32.exe

FCopy::
c:\windows\ServicePackFiles\i386\explorer.exe | c:\windows\explorer.exe
c:\windows\$NtServicePackUninstall$\wscntfy.exe | c:\windows\System32\wscntfy.exe
C\Documents and Settings\Admin\rundll32.exe | C:\WINDOWS\system32\rundll32.exe
RenV::
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Creative\Software Update 3\softauto .exe
c:\program files\Diskeeper Corporation\Diskeeper\dkicon .exe
c:\program files\DivX\DivX Update\divxupdate .exe
c:\program files\Logitech\Logitech WebCam Software\lws .exe
c:\program files\PeerBlock\peerblock .exe
c:\program files\RocketDock\rocketdock .exe
c:\program files\SUPERAntiSpyware\superantispyware .exe
c:\windows\system32\config\systemprofile\Desktop\rundll32 .exe

AtJob::

File::
c:\program files\internet explorer\wmpscfgs.exe
c:\windows\system32\w.exe
c:\windows\system32\8921.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vilemorumi"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vilemorumi]

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* SAS and MBAM
* C:\ComboFix.txt
* C:\MGlogs.zip

 

No problem. Safe surfing.