LOGS - after completing the READ & RUN ME FIRST Malware removal guide

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Use windows explorer to find and delete:
C:\Users\Balaji\Desktop\bProtectorForWindows
C:\bProtectorForWindows
C:\Users\Balaji\AppData\Local\Temp\REG5873.tmp
C:\Users\Balaji\AppData\Local\Temp\REG5874.tmp
C:\Users\Balaji\AppData\Local\Temp\REG66D3.tmp
C:\Users\Balaji\AppData\Local\Temp\REG6CBC.tmp

Tell me how things are running.

 

Since I am not seeing them in your logs, tell me the full path to them.

 

Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\MGlogs.zip

 

From your Newfiles.txt log in MGLogs.zip:

Code:

Locating all files created in "C:\Users\Balaji\Documents" within the last 90 days.  
                                                                              
---ha-w             1,774 2012-05-06 09:33:10  C:\Users\Balaji\Documents\Default.rdp
----a-w               393 2012-07-08 19:14:27  C:\Users\Balaji\Documents\forum links.txt

I can't remove what I don't see.