Help with malware please

You need to allow MGTools to run until completion.

In the meantime:

Now let's use ComboFix to remove a bunch of malware files.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
[ If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
c:\windows\system32\bugeyumo.dll.tmp
c:\windows\system32\noyuruwi.dll.tmp
c:\windows\system32\rojuyenu.dll.tmp
c:\windows\system32\fotagehi.dll

RegLockDel::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InprocServer32]
@DACL=(02 0000)
@="c:\\windows\\system32\\fotagehi.dll"
"ThreadingModel"="Both"

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it and let it run until it tells you to press any key. (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

 

There are too many accounts with admin. privileges! You need to run SAS and MBAM on each account.

In the meantime, use windows explorer to find and delete:
C:\WINDOWS\system32\dahonogo

Now use add/remove programs to uninstall:
J2SE Runtime Environment 5.0 Update 6

Reboot and install:
Java Runtime 6.

Now, go to start / run / type "cmd" without quotes and in the command box type:
ipconfig /all

Tell me what it shows.

 

Please attach the logs that found additional malware named so I can tell which accounts they are from.

Are you saying that when you ran the ipconfig.....nothing returned? No info at all?

You will have to manually reconfigure your ip address ...so I suggest you post in the networking forum for assistance on that issue.

 

You are most welcome......hope they get you straightened out.