Have logs/need help/cmd.exe takeover

Please double-click the RootRepeal.exe previously downloaded.

* Select File then Scan
* On the Select Drives form select drive C by "ticking" the box for drive C and click OK
* When the scan is complete - highlight each of the following file(s) (one at a time if more then one is listed) by left clicking it. Then use right mouse click and select the Wipe File option only for each file.

* After Wiping all files, immediately reboot your pc!

After reboot, download/install/update and run the scanning tools you couldn't run!

NOTE: I got tired of trying to edit it all.

 

You still need to finish the instructions, attach these logs:
SAS
MBAM
ComboFix
C:\MGlogs.zip

What we removed may have only been part of the infection. I need to see the logs to check.

 

Please use add/remove programs to uninstall:
Java 2 Runtime Environment, SE v1.4.2_03"
Java(TM) 6 Update 11"
Java(TM) 6 Update 3"
Java(TM) 6 Update 4"
Java(TM) 6 Update 7"
Java(TM) SE Runtime Environment 6

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

Files::
c:\windows\Tasks\A37CC062918B71D6.job
c:\docume~1\razorb~1\applic~1\intern~1\name idle dvd.exe
C:\WINDOWS\SYSTEM32\hjgruincnpugeh.dat
C:\WINDOWS\SYSTEM32\DRIVERS\lyyyo.sys
C:\WINDOWS\Temp\1268655967.exe
C:\WINDOWS\Temp\2598643376.exe
C:\WINDOWS\Temp\2897509823.bat
C:\WINDOWS\Temp\2E.tmp
C:\WINDOWS\Temp\904261936.bat
C:\WINDOWS\Temp\D8.tmp
C:\WINDOWS\Temp\windir.exe
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\82.TMP      
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\94.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\9F.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\Acr13A.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\Acr13C.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\Acr14C.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\Acr14E.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\Acr156.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\Acr162.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\pcf1.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\pcf2.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\pcf3.tmp
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\pcf7F.tmp
c:\windows\SYSTEM32\banusilo.exe
c:\windows\SYSTEM32\berikeda.dll.tmp
c:\windows\SYSTEM32\biyupufe.exe
c:\windows\SYSTEM32\domanabi.dll.tmp
c:\windows\SYSTEM32\dorajofo.dll.tmp
c:\windows\SYSTEM32\fetutupi.dll.tmp
c:\windows\SYSTEM32\hijiwuba.exe
c:\windows\SYSTEM32\jilubeju.dll.tmp
c:\windows\SYSTEM32\kisijegu.exe
c:\windows\SYSTEM32\lomugiti.dll.tmp
c:\windows\SYSTEM32\lowopami.dll.tmp
c:\windows\SYSTEM32\mewisale.dll.tmp
c:\windows\SYSTEM32\misahavu.dll.tmp
c:\windows\SYSTEM32\mufokuvo.exe
c:\windows\SYSTEM32\nenunizo.dll.tmp
c:\windows\SYSTEM32\niludesa.dll.tmp
c:\windows\SYSTEM32\poriyibu.dll.tmp
c:\windows\SYSTEM32\repuwere.exe
c:\windows\SYSTEM32\rihuhavu.exe
c:\windows\SYSTEM32\ruyebana.exe
c:\windows\SYSTEM32\somotiye.dll.tmp
c:\windows\SYSTEM32\tofuropi.dll.tmp
c:\windows\SYSTEM32\tuvumuge.dll.tmp
c:\windows\SYSTEM32\vefemiju.dll.tmp
c:\windows\SYSTEM32\visegobu.exe
c:\windows\SYSTEM32\weduriwi.dll.tmp
c:\windows\SYSTEM32\yitidena.dll.tmp
c:\windows\SYSTEM32\yukufepo.exe
c:\windows\SYSTEM32\zavitife.exe
C:\32788R22FWJFW.0.tmp
c:\documents and settings\All Users\Application Data\great coal love default\wma seek.exe
c:\documents and settings\razorbladedeity\Application Data\INTERNET BIN KEEP\kdgootdv.exe
c:\documents and settings\razorbladedeity\Application Data\INTERNET BIN KEEP\name idle dvd.exe
c:\documents and settings\razorbladedeity\Application Data\INTERNET BIN KEEP\Bend Proxy Cast.exe

Folders::
c:\documents and settings\All Users\Application Data\great coal love default
c:\program files\INTERNET BIN KEEP
c:\documents and settings\razorbladedeity\Application Data\INTERNET BIN KEEP
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\{06B81FB6-3AC8-4D4D-9C38-7D6910E00425}
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\{38635735-3A16-4A6A-A166-EDF505068383}
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\{927CFD07-123F-4B31-B08B-715D18155E44}
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\{9B91C9A1-6C17-45DA-AA30-88525C90DBF2}
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\{C53EF392-3178-4A9F-9FA3-FCA58B10D7B6}
C:\Documents and Settings\razorbladedeity\Local Settings\Temp\{FC714003-A5CF-4F0E-9A21-7317719B1CDC}

Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d916b6ae-e006-415d-b19b-9a342f592acd}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Blue Bits"=-

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now download and install:
Java Runtime 6

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!