Possible spyware/malware/rootkit may be hiding on my system

bras33 · Sep 22, 2011

Hello there. I really need help. I am running windows 7 home basic 32-bit. Lately my system has become really slow, the computer hangs a lot also. I tried everything I could but nothing seems to works. I am almost 100% sure it's some kind of stealth spyware/malware/rootkit. I did every step in the READ AND RUN ME 1ST but I have I couldn't come up with the ComboFix log and the RootRepeal log as the cannot run. ComboFix began to load but I waited like 10 minutes for something to come up but nothing appeared, I tried to uninstall it, began to load but after that nothing, no signs of any kind. The RootRepeal created 3 similar logs that I really don't understand. I'll be attaching them also. I am attaching the other logs and I really hope my system is clean. Thank You.

bras33 · Sep 22, 2011

The other 2 RootRepeal crash log.... Thanks

thisisu · Sep 22, 2011

Hi and welcome to Major Geeks, bras33!

http://dus.x10.mx/canned/otlicon.gifPlease download OTL by Old Timer to your desktop.

See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
Double-click OTL.exe to run (Vista and Win7 right click and select Run as administrator)

When OTL opens, copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.

Code:

[COLOR="DarkRed"]:processes[/COLOR]
killallprocesses
[COLOR="DarkRed"]:otl[/COLOR]
[COLOR="DarkRed"]:services [/COLOR]
ZKUTCZYKDHJH
66E5F876
[COLOR="DarkRed"]:files[/COLOR]
C:\ComboFix\
C:\Users\Sebastien\AppData\Local\Conduit
dir "C:\Users\Sebastien\AppData\Local\Roozz\" /c
C:\Users\Sebastien\Desktop\ComboFix.exe
C:\Users\Sebastien\Desktop\ÐÂ½¨ÎÄ±¾ÎÄµµ.txt
C:\ProgramData\{657095DF-DBDB-4B17-8245-B38845C97069}
C:\ProgramData\{E91883C8-8CDC-46A4-A45F-CB40EB82ED60}
C:\ProgramData\¡¸¿ªÊ¼¡¹²Ëµ¥
C:\ProgramData\ÊÕ²Ø¼Ð
C:\ProgramData\×ÀÃæ
C:\32788R22FWJFW
C:\{C12DFF20-BA96-4A98-9722-2B7B9AABEB03}
C:\Windows\temp\tfxz
C:\USERS\SEBAST~1\LOCALS~1\TEMP\tfxz
C:\Users\Sebastien\AppData\Local\{01A8C2D7-5A16-4A3E-B4AA-0AC9B6385610}
C:\Users\Sebastien\AppData\Local\{08E7CF06-9EB1-495B-BDB7-ADCD83C7039C}
C:\Users\Sebastien\AppData\Local\{0AD4F6C2-1C38-49DA-9A16-A7ACD9330C35}
C:\Users\Sebastien\AppData\Local\{0D5B1E78-FE7A-4EFD-AC76-E4838F5872DD}
C:\Users\Sebastien\AppData\Local\{10DD17E1-3A60-4901-978A-899B38FBF111}
C:\Users\Sebastien\AppData\Local\{12DA5657-44ED-45F5-8E01-BC542551DC02}
C:\Users\Sebastien\AppData\Local\{14F16633-0975-4BDC-A4F0-D33B3B89FEB1}
C:\Users\Sebastien\AppData\Local\{17208619-8418-4649-8806-3822F185482B}
C:\Users\Sebastien\AppData\Local\{18396A1D-B71A-4263-9629-0ED38C83ADE8}
C:\Users\Sebastien\AppData\Local\{1908A6E3-DDA1-4DA5-9789-F486088832DE}
C:\Users\Sebastien\AppData\Local\{1DD9E600-41F2-464F-816F-3523CC1D48C2}
C:\Users\Sebastien\AppData\Local\{20868B98-378E-4C09-8425-1B8078F726D1}
C:\Users\Sebastien\AppData\Local\{25A53AD1-5841-4E5A-A54D-FFE52D3F67C2}
C:\Users\Sebastien\AppData\Local\{29257B9C-4C76-491E-8B45-271E5603C851}
C:\Users\Sebastien\AppData\Local\{2EA11B13-A0FB-47D8-BE4F-AED6A0C9923E}
C:\Users\Sebastien\AppData\Local\{31246B3D-AF65-4A72-A02D-A9BBD103DBF3}
C:\Users\Sebastien\AppData\Local\{31760276-1CCA-42DB-A942-59FCA8C30038}
C:\Users\Sebastien\AppData\Local\{32056852-FE1B-45B4-A603-097F3B56A673}
C:\Users\Sebastien\AppData\Local\{333D6113-3783-4F0B-9E71-89E727D23EC0}
C:\Users\Sebastien\AppData\Local\{35BE2D3D-37DC-47E2-9985-98FE57573CDF}
C:\Users\Sebastien\AppData\Local\{36C0B97F-A50F-4E50-B9A4-CB6946262559}
C:\Users\Sebastien\AppData\Local\{3715A4AB-B9A5-46F1-BC77-181DC4D0D9D8}
C:\Users\Sebastien\AppData\Local\{37E11A5E-9960-4B13-9DF5-2D373F07B45D}
C:\Users\Sebastien\AppData\Local\{3D679A3D-CAC2-4B61-9309-324CD2559C97}
C:\Users\Sebastien\AppData\Local\{3F1F9C72-12B9-4C19-B9DF-889FE4EDBD33}
C:\Users\Sebastien\AppData\Local\{415D2F69-CC14-4053-8448-31B07CD79932}
C:\Users\Sebastien\AppData\Local\{4552A674-AE07-49AB-B86F-A19F814C9696}
C:\Users\Sebastien\AppData\Local\{456F0817-CB18-4DD7-84F3-4ED83E0A7A46}
C:\Users\Sebastien\AppData\Local\{52F7BEDC-03A1-4C36-8F32-33CE58868433}
C:\Users\Sebastien\AppData\Local\{53300FEB-75DA-452F-9B84-7C68248C9C97}
C:\Users\Sebastien\AppData\Local\{5D0F0664-D301-4CC5-82B9-E7FBF2892BCB}
C:\Users\Sebastien\AppData\Local\{5D7AF73A-B61B-422D-8884-17A6734812D4}
C:\Users\Sebastien\AppData\Local\{64023BF0-2F14-4A0E-932B-1832BBCE0C74}
C:\Users\Sebastien\AppData\Local\{6426C6B1-28D9-4C44-AB81-2BB9370B40BF}
C:\Users\Sebastien\AppData\Local\{6783FFE2-AB07-4637-A8CB-98FDB1F11F10}
C:\Users\Sebastien\AppData\Local\{67AFCAC8-1A5C-489D-914C-B52A3D4ECD7F}
C:\Users\Sebastien\AppData\Local\{685FFF71-4DF1-49BE-B3E6-A04A5546CAAB}
C:\Users\Sebastien\AppData\Local\{69E52041-A018-4DDD-8963-2809E43F6B7F}
C:\Users\Sebastien\AppData\Local\{6B9C800E-FC52-449C-A8E5-457E2EB619AE}
C:\Users\Sebastien\AppData\Local\{6E7C5316-EE0D-4DA1-BEC7-09850399753F}
C:\Users\Sebastien\AppData\Local\{70732C26-7475-41B2-9F9A-5BF3D39BA08F}
C:\Users\Sebastien\AppData\Local\{70A80F52-7947-4758-8413-E9282FDBE580}
C:\Users\Sebastien\AppData\Local\{745FD0F9-0A1C-47C4-A631-0651A2F36B47}
C:\Users\Sebastien\AppData\Local\{751828B4-7EA6-42E7-A5AB-9D311F3821DB}
C:\Users\Sebastien\AppData\Local\{75D10D55-9FFD-450B-91B9-E311950E7CE7}
C:\Users\Sebastien\AppData\Local\{762CAD5C-768F-4309-B676-65ABB818EDD2}
C:\Users\Sebastien\AppData\Local\{766990D1-D5E2-4E88-96CF-1D685C4664BD}
C:\Users\Sebastien\AppData\Local\{76C1A2E3-8B6D-4D23-937E-1F9640523A7A}
C:\Users\Sebastien\AppData\Local\{79B4E947-68AC-47E0-919A-BDA1B9CAD6B2}
C:\Users\Sebastien\AppData\Local\{7A82489E-40AF-487D-9E17-FE082F14BB9B}
C:\Users\Sebastien\AppData\Local\{7FA974D6-341A-4F45-9FAC-755155E7DA0C}
C:\Users\Sebastien\AppData\Local\{8456A75A-1593-4ABE-8073-244B66FE8244}
C:\Users\Sebastien\AppData\Local\{8478F059-F89F-4AA0-9278-C45F4563BD72}
C:\Users\Sebastien\AppData\Local\{84D74AD7-F92B-40CC-ADBA-811949C8AED3}
C:\Users\Sebastien\AppData\Local\{84FD3DFB-2DC6-461E-BD6D-A1EF324419BB}
C:\Users\Sebastien\AppData\Local\{85ADDF9B-8CC7-4175-838E-B137036AC4B6}
C:\Users\Sebastien\AppData\Local\{8825F055-36A7-47C4-8730-8717774F0E4B}
C:\Users\Sebastien\AppData\Local\{89C2A409-3835-4A73-ACA9-4C89CB68CB5C}
C:\Users\Sebastien\AppData\Local\{8A6B683B-677F-4C45-93BC-8FEDA666F232}
C:\Users\Sebastien\AppData\Local\{8B4F4B1D-07E0-4187-A723-802985C8C4A2}
C:\Users\Sebastien\AppData\Local\{8DACAA82-E58E-4691-AD01-96DC5732E357}
C:\Users\Sebastien\AppData\Local\{8E6BA375-57ED-4512-B21B-9F1FAB014E36}
C:\Users\Sebastien\AppData\Local\{8E86B7C1-FF14-4C66-B1BC-41E9DD22007C}
C:\Users\Sebastien\AppData\Local\{928F211A-A826-4B0C-A79E-F14E21C1B525}
C:\Users\Sebastien\AppData\Local\{9312C1DB-015C-4C93-A5A0-06F601CA1D65}
C:\Users\Sebastien\AppData\Local\{981B40AA-340F-4A18-A9F4-2B13FBB00C5D}
C:\Users\Sebastien\AppData\Local\{99BCA24E-B833-4074-955A-3EC8B622DBA6}
C:\Users\Sebastien\AppData\Local\{9E33AC69-0703-42DB-AE3E-DEC0DD78DA10}
C:\Users\Sebastien\AppData\Local\{A3DAC79D-5318-4728-80DB-0CC6CFF62C28}
C:\Users\Sebastien\AppData\Local\{A580723D-361E-4EFA-93CC-E0A716BF3A9D}
C:\Users\Sebastien\AppData\Local\{A64D871E-24AA-4CB9-8ADA-BD24DE52699F}
C:\Users\Sebastien\AppData\Local\{AB39F3E9-E817-4176-9F6E-585896F1F191}
C:\Users\Sebastien\AppData\Local\{B086D322-641F-4258-8194-D206E14C7516}
C:\Users\Sebastien\AppData\Local\{B091F249-EE65-48F3-B0E0-636E315BEFFA}
C:\Users\Sebastien\AppData\Local\{B1C584BA-FC20-44E8-B7A6-56251AC6B6F5}
C:\Users\Sebastien\AppData\Local\{B3D52FAB-08D0-479B-BEE6-D821246E5FF4}
C:\Users\Sebastien\AppData\Local\{B695D22B-8B40-4979-8D59-0B3E69A9CC91}
C:\Users\Sebastien\AppData\Local\{B8C9E8E6-2E58-4F04-9925-C0231641AB1D}
C:\Users\Sebastien\AppData\Local\{BBF2BE0F-0BBE-489E-B8C0-8E2CA0B35E85}
C:\Users\Sebastien\AppData\Local\{BCC5AEBB-429B-4017-9867-74879DDD0176}
C:\Users\Sebastien\AppData\Local\{BF095969-BA32-43F2-8E2D-2F173AB22458}
C:\Users\Sebastien\AppData\Local\{BFA525F5-AD89-4D1F-9E5E-4C627DB522DE}
C:\Users\Sebastien\AppData\Local\{C242028D-8EFA-4875-8DC5-C5B55AA8BE72}
C:\Users\Sebastien\AppData\Local\{CF00FA7E-E0E7-4893-8B4D-76582DDC9574}
C:\Users\Sebastien\AppData\Local\{CF409ADF-A138-4962-83FD-0D9B4F76CFB7}
C:\Users\Sebastien\AppData\Local\{D0F52F19-FD66-4DEF-BB37-1F5C2878ADDB}
C:\Users\Sebastien\AppData\Local\{D191859E-E294-4E25-AB9F-0B7FF8837B83}
C:\Users\Sebastien\AppData\Local\{D5540C9F-0FDD-4183-A9EE-8FED8AE1A374}
C:\Users\Sebastien\AppData\Local\{D82B8CCA-0B81-45F5-9EB7-C9BC2DB47506}
C:\Users\Sebastien\AppData\Local\{DCF2819F-1074-4B60-98EB-874B3C0D1E33}
C:\Users\Sebastien\AppData\Local\{E2AE2E51-0D66-446E-A168-1652A2D9B5B9}
C:\Users\Sebastien\AppData\Local\{E2B49646-0ACB-4483-9843-E6538CD28D7A}
C:\Users\Sebastien\AppData\Local\{E34F78BE-FF95-458C-B9F3-6DA201718ACF}
C:\Users\Sebastien\AppData\Local\{E393E633-F358-4B75-A067-78BAB2E669A3}
C:\Users\Sebastien\AppData\Local\{E4681F8B-9A29-4B24-BC34-5D7914F2492C}
C:\Users\Sebastien\AppData\Local\{E5214D0A-0B58-4C9C-B436-4EA1624F22D9}
C:\Users\Sebastien\AppData\Local\{E8D20443-BEF4-4AC4-B505-511D913D5CE7}
C:\Users\Sebastien\AppData\Local\{E9FD6F33-9B43-478E-AF80-D513BE54ECFA}
C:\Users\Sebastien\AppData\Local\{EB9ECB41-783B-4D2A-B331-6B6E495452C5}
C:\Users\Sebastien\AppData\Local\{ED3B4BCB-C1CC-48E1-BE9E-FFBAD34A00DF}
C:\Users\Sebastien\AppData\Local\{EF33378C-463B-4448-A3E0-55777E684E58}
C:\Users\Sebastien\AppData\Local\{F1790E8C-C86C-439C-91E8-D32BB1E49803}
C:\Users\Sebastien\AppData\Local\{F4499B3F-6ED9-471F-A9C6-325616EFEB6A}
C:\Users\Sebastien\AppData\Local\{F78D215C-CFF8-4389-A980-64E271E4CCCB}
C:\Users\Sebastien\AppData\Local\{F85EEDCE-4B3C-4128-BD83-20A11BCC62BD}
C:\Users\Sebastien\AppData\Local\{F8D30EB8-0C33-4286-B3FE-391AFA407E65}
C:\Users\Sebastien\AppData\Local\{F8F3D28B-4A8C-4AF0-AB06-6E1DCE673FA0}
C:\Users\Sebastien\AppData\Local\{FA4B277E-A1E6-4A17-911A-97ADFD2A839F}
C:\Users\Sebastien\AppData\Local\{FB6DE173-E208-4F0F-90A3-4B593C6979CC}
C:\Users\Sebastien\AppData\Local\{FEAAF658-8779-4033-BD33-4DAE840F49BB}
C:\Windows\system32\66E5F876.exe
C:\Users\SEBAST~1\AppData\Local\Temp\ZKUTCZYKDHJH.exe
xcopy %Temp%\smtmp\1 "%allusersprofile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%appdata%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%allusersprofile%\Desktop" /H /I /S /Y /C
[COLOR="DarkRed"]:reg[/COLOR]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{c99fdc39-a1ae-4b24-8d71-e5274f8d7c54}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[COLOR="DarkRed"]:commands[/COLOR]
[purity]
[createrestorepoint]
[emptytemp]
[emptyflash]

Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
OTL may ask to reboot the machine. Please do so if asked.
Click the OK button.
When complete, Notepad will open.
Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach items to your post)

Now open OTL again and click the http://img683.imageshack.us/img683/4483/quickscanotl.png button
Note: This automatically updates the OTL.txt log on your desktop.
Attach OTL.txt to your next message. (How to attach items to your post)

http://img685.imageshack.us/img685/3557/tdsskiller.gif Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)

Please download MBRCheck by GeeksToGo to your desktop.
See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
It will show a Black screen with some information that will contain either the below line if no problem is found:
- Done! Press ENTER to exit...
Or you will see more information like below if a problem is found:
- Found non-standard or infected MBR.
- Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
Attach this log to your next message. (How to attach items to your post)

http://img839.imageshack.us/img839/3005/combofixicon.gif Now retry downloading and running ComboFix. Attach its log if it works this time. You can download it from here: Download ComboFix

http://img822.imageshack.us/img822/6835/baticon.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

This will automatically update all the logs inside MGlogs.zip
Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

bras33 · Sep 22, 2011

Hello, thank you for giving me an answer this fast!!! I am attaching the logs.

bras33 · Sep 22, 2011

The last 2 logs. And thank you for helping me I really appreciate it!!!!

thisisu · Sep 22, 2011

YOU HAVE AN INFECTED MASTER BOOT RECORD (MBR)!

_________________________________________________________________
WARNING

MBR infections are only worsening and sometimes (rarely) make the computer unbootable after attempting to correct it. We recommend that you back up your data before hand. Then continue with the below if you wish to attempt to remove this infection:
_________________________________________________________________

Do you have your Windows 7 DVD? We need it to restore a clean MBR.
If you do not have your Windows 7 DVD, you can create one with the Recovery Console (which is really all we need), here: Download Windows 7 32-bit (x86) Recovery Disc

Insert the DVD

Reboot your computer

At the Hewlett Packard (HP) splash screen, press Esc

This takes you to the Boot Menu

Select CD/DVD Rom from the selection by using the Down / up arrows (Note: It will probably be hp DVD RW AD-7586H or something similar [according to your logs])

Press ENTER after you have selected the CD/DVD Rom drive.

You'll hear the DVD spinning up, be ready to press ANY key when you see the following message:

http://www.bleepstatic.com/tutorials/vista-repair-options/boot-from-cd-prompt.jpg

This takes a while to load (30-45 seconds)

When the below screen appears:

http://www.sevenforums.com/attachments/tutorials/25672d1251414873-mbr-restore-windows-7-master-boot-record-mbr_02.png

Select your language and click Next.

http://www.sevenforums.com/attachments/tutorials/25673d1251414836-mbr-restore-windows-7-master-boot-record-mbr_03.png

Click the button for "Use recovery tools".

http://www.sevenforums.com/attachments/tutorials/25674d1251414836-mbr-restore-windows-7-master-boot-record-mbr_04.png

Then select "Command Prompt".

http://www.sevenforums.com/attachments/tutorials/25675d1251414836-mbr-restore-windows-7-master-boot-record-mbr_05.png

When open, the command prompt will look like this:

http://www.sevenforums.com/attachments/tutorials/53598d1251414836-mbr-restore-windows-7-master-boot-record-mbr_16.png

Type in bootrec /fixmbr and press ENTER
Note: There is only a SPACE after bootrec

You should see:

http://img19.imageshack.us/img19/4114/operationcompletedsucce.png

Type exit and press ENTER

Now restart your computer WITHOUT booting off the DVD again (don't press a key when it says... "press any key to boot from cd/dvd...")

Now rerun MBRCheck and attach its latest log. (How to attach items to your post)

Let me know how the PC is running.

bras33 · Sep 22, 2011

Hi, I wanted to know what the infection is exactly. I will be downloading the recovery disc and repairing the MBR soon but just out of curiosity can you tell me what it is? Some kind of spyware??? Thank You.

thisisu · Sep 22, 2011

bras33 said: ↑

Hi, I wanted to know what the infection is exactly. I will be downloading the recovery disc and repairing the MBR soon but just out of curiosity can you tell me what it is? Some kind of spyware??? Thank You.
Click to expand...

Some kind of malware. Not sure what exactly, one that messes up the MBR

bras33 · Sep 23, 2011

Good morning!! Here's the MBRCheck after using the recovery disc. Thanks

bras33 · Sep 23, 2011

Computer is still running!!!

thisisu · Sep 23, 2011

bras33 said: ↑

Good morning!! Here's the MBRCheck after using the recovery disc. Thanks
Click to expand...

Good, MBR infection is gone.
Just a few more things to clear up.

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!

If it is not on your desktop, the below will not work.

Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.

Open Notepad and copy/paste the text in the below code box into Notepad:
Code:
[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
MEMSWEEP2
[COLOR="DarkRed"]File::[/COLOR]
c:\users\Default\¡¸¿ªÊ¼¡¹²Ëµ¥
c:\programdata\×ÀÃæ
c:\programdata\ÊÕ²Ø¼Ð
c:\programdata\¡¸¿ªÊ¼¡¹²Ëµ¥
C:\Users\Sebastien\Desktop\ÐÂ½¨ÎÄ~1
C:\Users\Sebastien\Desktop\ÐÂ½¨ÎÄ~1.txt
c:\windows\system32\42C8.tmp
[COLOR="DarkRed"]FileLook::[/COLOR]
c:\windows\system32\poqexec.exe
[COLOR="DarkRed"]Folder::[/COLOR]
C:\Users\Sebastien\AppData\Local\{008C43CA-2A1E-44BA-98F6-8E2A00C52D16}
C:\Users\Sebastien\AppData\Local\{67471993-21C2-4D5C-AA99-9ECD9E83A711}
C:\ProgramData\¡¸¿ªÊ¼~1
C:\ProgramData\ÊÕ²Ø¼Ð
C:\ProgramData\×ÀÃæ
C:\Windows\temp\tfxz
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_USERS\S-1-5-21-3774822024-294525419-2627115759-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3774822024-294525419-2627115759-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe

At this point, you must exit all browsers now before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your desktop.

Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

This shall launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Allow ComboFix to update itself if prompted.

When it finishes, a log will be produced at C:\ComboFix.txt
Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

Attach this log to your next message. (How to attach items to your post)

http://img822.imageshack.us/img822/6835/baticon.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

This will automatically update all the logs inside MGlogs.zip

Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS

bras33 · Sep 23, 2011

The ComboFix and MGtools logs... Thanks

thisisu · Sep 23, 2011

Latest logs look good, what problems (if any) are you having?

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis if it present

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

bras33 · Sep 23, 2011

Hello, thank you for helping me throughout this process. But I have a big favor to ask. Can you do a complete check of my computer again? Like check every area to see if I am really clean. The thing is I am living with someone in a house and I suspect that she put some kind of spyware in my computer, cause she's knows how to do it (I have heard this from some people). That's why I asked you the last time if the infection was some kind of spyware. My laptop used to stay power on even if I am not present. I am not really good at computers but if she had really put it could she like know that I am trying to clean it and put this spyware at a stealth mode that it could get undetected or just move it for just the time I am trying to clean it (if there is really a spyware)? We are also using the same Wi-Fi; so could she hack me and drop the spyware again after the computer is clean? I just want to get informed for the next time. And please I really need you to do a complete check of every area of my computer if you can. Thanks

thisisu · Sep 23, 2011

Rest assured your logs are clean

bras33 · Sep 23, 2011

Can you please check again? And you did not answer any of my questions. Thanks

thisisu · Sep 23, 2011

We are also using the same Wi-Fi; so could she hack me and drop the spyware again after the computer is clean?
Click to expand...

If you guys are sharing the same Internet and are networked together I suppose this is possible.

And please I really need you to do a complete check of every area of my computer if you can.
Click to expand...

I have already checked all your logs multiple times, I don't see any problems. What problems are you experiencing?If you want to run some more thorough tests, complete the below:

ESET Online Scanner

Do the scan once

Reboot your PC when it is finished!

Go back to do the scan AGAIN

Reboot your PC AGAIN when it is finished!

Do the scan for a 3rd and final time

Reboot your PC AGAIN when it is finished!

Come back here and Attach all 3 logs from the 3 scans here.

bras33 · Sep 23, 2011

No, it's ok. If you say it's clean it's clean. I am just gonna follow the final steps. Thank You very much for helping me!! I just wanted to be sure everything was cleaned.

thisisu · Sep 23, 2011

No problem. Surf safely

Possible spyware/malware/rootkit may be hiding on my system

bras33 Private E-2

Attached Files:

bras33 Private E-2

Attached Files:

thisisu Malware Consultant

bras33 Private E-2

Attached Files:

bras33 Private E-2

Attached Files:

thisisu Malware Consultant

bras33 Private E-2

thisisu Malware Consultant

bras33 Private E-2

Attached Files:

bras33 Private E-2

thisisu Malware Consultant

bras33 Private E-2

Attached Files:

thisisu Malware Consultant

bras33 Private E-2

thisisu Malware Consultant

bras33 Private E-2

thisisu Malware Consultant

bras33 Private E-2

thisisu Malware Consultant