Issues with Computer - please help?

Please Disable Spybot's TeaTimer --> Should have been done as per the R&R instructions!

* Run Spybot and click Mode
* Select Advanced Mode.
* Then click Tools and select Resident.
* Now in the right window pane, uncheck TeaTimer.
* Also while this is open, in the left column now select IE Tweaks
* and then in the right pane make sure all the Miscellaneous locks are unchecked.
* Now quit Spybot!

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\WINDOWS\Gbynea.exe
C:\WINDOWS\Pobdsjsy.dll
C:\WINDOWS\Qkofureqijolo.bin
C:\WINDOWS\"Rhiduyajasuqebo.dat
C:\WINDOWS\trz399.tmp
C:\WINDOWS\system32\clicoafg.dat
C:\WINDOWS\system32\ftsrcs.dat
C:\WINDOWS\system32\hsfcisu2.dat
C:\WINDOWS\system32\kbdjpni.dat
C:\WINDOWS\system32\kbdmaorr.dat
C:\WINDOWS\system32\slbrccsb.dat
C:\WINDOWS\system32\srrstm.dat
C:\WINDOWS\system32\strmfikt.dat
C:\WINDOWS\system32\uzdkd.exe
C:\WINDOWS\temp\VGX1A.tmp
C:\WINDOWS\temp\VGX1B.tmp
C:\WINDOWS\temp\VGX1C.tmp
C:\WINDOWS\temp\VGX374.tmp
C:\WINDOWS\temp\VGX375.tmp
C:\WINDOWS\temp\VGX376.tmp
C:\WINDOWS\temp\VGX377.tmp
C:\WINDOWS\temp\VGX378.tmp
C:\WINDOWS\temp\VGX379.tmp
C:\WINDOWS\temp\VGX37A.tmp
C:\WINDOWS\temp\VGX37B.tmp
C:\Documents and Settings\Owner\Local Settings\temp\5.tmp 
c:\documents and settings\Owner\Application Data\Microsoft\gb_82453.bat
c:\windows\Gbynei.exe
c:\windows\Gbyneh.exe
c:\windows\Gbyneg.exe
c:\windows\Gbynef.exe
c:\windows\Gbynee.exe
c:\windows\Gbyned.exe
c:\windows\Gbynec.exe
c:\windows\Qkofureqijolo.bin
c:\windows\Gbyneb.exe
c:\windows\Gbynea.exe

Folder::
C:\Documents and Settings\Owner\Application Data\3eda.fe4 
C:\Documents and Settings\Owner\Application Data\Wuyht

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Hvacokonipuco"=-
"VD6TK7MFWR"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}]

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Note: If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

I would also suggest you uninstall:
RegistryPowerCleaner

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!


Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
• If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).
  
  • If you do not see the file extension, please refer to: How to view hidden, system files & folders!
• Click the Start Scan button.
• Do not use the computer during the scan
• If the scan completes with nothing found, click Close to exit.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_14.17.05_log.txt) will be created and saved to the root directory ( usually Local Disk C ).
• Attach this log to your next message

Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  
  • Done! Press ENTER to exit...
  
  
• Or you will see more information like below if a problem is found:
  
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  
  
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* TDSKiller log
* MBRCheck log
* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Your D: drive is still being reported as infected. Let's see if MBRCheck can fix it.

* Run MBRCheck.exe
* Wait until you see the following lines:
o Enter 'Y' and hit ENTER for more options, or 'N' to exit:
o Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice:

* Please push the 'Y' key and then press Enter
* When the program asks you to Enter your choice: enter 2 to Restore the MBR and press the Enter key
* Now the program will ask you to "Enter the physical disk number to fix (0-99, -1 to cancel):"
o Enter 1 and press the Enter key.
* The program will show Available MBR codes as below

* You need to select your version of Windows from the list. For example, enter 0 or 1 for XP or enter 3 for Vista.....etc. and then press Enter.
* The program will prompt for confirmation. Type 'YES' and hit Enter.
* Left click on the title bar (where program name and path is written). From menu chose Edit -> Select All
* You will see all the text in the window get highlighted.
* Hit the Enter key on your keyboard to copy all of the text into the clipboard.
* Paste that text into Notepad, save it to your desktop as MBRfix.txt
* Restart your PC.
* Attach the MBRfix.txt file to your next message..

Now please re-run MBRCheck.exe and attach that log also.

Also, use windows explorer to find and delete:
C:\Documents and Settings\Owner\Application Data\3eda.fe4

 

Sadly it did not fix it. Do you have your OS cd? We will need to get into the recovery console to fix this.