Need an all clear 2

Bill175 · Jan 11, 2010

Tried to add logs to my post and the thread is locked - sorry I had to start another one. Here are 4 of the 5 logs from the Read Me - It says Combofix is not available for download right now, so that is not included. I was hit with multiple viruses and I THINK I've cleared them all. I was wondering if somebody could look and see if they look clear.
Thanks!

TimW · Jan 13, 2010

Let's start with this:

Please use add/remove programs to uninstall:
Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME
J2SE Runtime Environment 5.0"
Java 2 Runtime Environment, SE v1.4.2_03

Download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\WINDOWS\Tasks\ueusnfih.job
C:\Documents and Settings\All Users\Application Data\sysReserve.ini
C:\zvxja6hw.sys
C:\WINDOWS\temp\0d930455-6757-44b3-b009-c13fc36b4adc
C:\WINDOWS\temp\40d9019d-c2d8-42c2-a7e8-430964bb3246
C:\WINDOWS\temp\ac4e853a-031f-4a2b-a036-01aa84a89282
C:\WINDOWS\temp\ca6ff8a4-b95e-450e-972d-0c0060b9b269
C:\WINDOWS\temp\f8938ac3-6f55-43fb-89fe-710e0a94a9bc
C:\WINDOWS\temp\ff770993-a702-406a-903e-41bd2ce88f3a
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\4otjesjty.mof
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\7zS49.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\7zS4A.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\c.dat
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\DIO156.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio17.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio1df.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio1f5.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio271.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio2b.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio2d5.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio32e.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio3ae.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio3ba.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio45.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio4c6.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio4dc.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio4e.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio565.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio573.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio581.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio5f.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio5f2.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio6.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio62f.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio63b.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio66.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio6a6.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio6ec.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio6f9.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio72a.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio751.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio768.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio775.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dio7d.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\diob.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\diob7.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dioc.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\diod.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dioe.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\dioe7.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\diof.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\h8s630.tmp
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\mm1.mht
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\mm2.mht
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\mm3.mht
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\mm4.mht
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\OB45I9T5.htm
C:\Documents and Settings\DanceOutfitters\Local Settings\temp\uac26ae.tmp

Folders to delete:
C:\WINDOWS\temp\0d930455-6757-44b3-b009-c13fc36b4adc
C:\WINDOWS\temp\40d9019d-c2d8-42c2-a7e8-430964bb3246
C:\WINDOWS\temp\ac4e853a-031f-4a2b-a036-01aa84a89282
C:\WINDOWS\temp\ca6ff8a4-b95e-450e-972d-0c0060b9b269
C:\WINDOWS\temp\f8938ac3-6f55-43fb-89fe-710e0a94a9bc
C:\WINDOWS\temp\ff770993-a702-406a-903e-41bd2ce88f3a
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner!

Now download and install:
Java Runtime 6

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

Need an all clear 2

Bill175 Private E-2

Attached Files:

MGlogs.zip

mbam-log-2010-01-11 (18-26-21).txt

rootrepeal.txt

SuperAntiSpywarelog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member