Hi - Help would be much appreciated:)

Hi all

Firstly let me say how fantasic a resource this website is for anyone online

okok
I have been experiencing weird virus/trojan behaviour on my puter for perhaps a week. By this i mean lots of popup windows when loading urls etc. I went out last week and bought zone alarm internet security and that slowed alot down however i have recently been getting an interesting error msg: windwwaa: Delete~1.exe which has been driving me crazy and led me to investigate all this futher.

I have then stumbled on your website and have followed the "Read& Run me First befrore asking for support" instructions.

I hope that you might be able to help me as this is starting to drive me bananas The two online scans picked up trojan.delphi14 and not sure how to get rid of that among all the other nasty stuff which is still getting found everytime i dow a scan

 

more attachments....i think that is all

 

Please post your CounterSpy log.

 

thanks

 

Download
- Pocket Killbox

The version of Adobe Acrobat installed on this computer is out-dated. Visit Adobe's website and install version 8 of Acrobat.

Using Add or Remove Programs in the Control Panel; uninstall the following:

Install Java Runtime Environment (JRE) 6 available from Sun Microsystems.

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop.

Close Notepad.

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Run HijackThis, choose "Open the Misc Tools Section", choose "Process Manager", Highlight:

Choose Kill Process. Click on the "Back" Button

Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

 

ok i have followed your instructions
Thank you so much for your help

here is the lastest hijack this log

 

Do you know what these 2 files are?

O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE

 

nope i don't but i have seen them before and thought they looked dodgy

 

Submit both files to VirusTotal for analysis and post the results in this thread.

 

The results are attached as a text doc i saved from the site.

 

Neither file appears to be malicious.

How is your computer running?

 

Much better it seems thank you
although i am now researching how to get rid of the annoying yahoo toolbar - any ideas?

 

Worked it out

http://support.microsoft.com/?kbid=303047

Thanks once again for your help

 

If you are not having any other malware problems, it is time to do our final steps:

• If we used Pocket Killbox during your cleanup, do the below
  • Run Pocket Killbox and select File, Cleanup, Delete All Backups
• If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
• If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
• If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
• If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
• If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
• You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
• If you are running Windows XP or Windows ME, do the below:
  • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
  • Then reboot and Enable System Restore to create a new clean Restore Point.
• After doing the above, you should work thru the below link:
  • How to Protect yourself from malware!