Removal of Rootkit-Agent.DI

I still need the log from running the C:\MGTools.exe --> C:\MGLogs.zip

And please tell me exactly what AVG is reporting....the exact path.

 

Let's do this:

Please use add/remove programs to uninstall:
Java 2 Runtime Environment Standard Edition v1.3.1_18

Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\WINDOWS\system32\0d38.sys      
C:\WINDOWS\system32\49d3.mht      
C:\Documents and Settings\DANIE\Local Settings\temp\svcb6.tmp
C:\Documents and Settings\DANIE\Local Settings\temp\SVG23.TMP 
C:\Documents and Settings\DANIE\Local Settings\temp\SVH53.TMP
C:\Documents and Settings\DANIE\Local Settings\temp\SVI3.TMP 
C:\Documents and Settings\DANIE\Local Settings\temp\SVLGM.TMP
C:\WINDOWS\system32\drivers\ndis.sys

Folder::
C:\Documents and Settings\DANIE\Local Settings\temp\svcb6.tmp
C:\Documents and Settings\DANIE\Local Settings\temp\SVG23.TMP 
C:\Documents and Settings\DANIE\Local Settings\temp\SVH53.TMP
C:\Documents and Settings\DANIE\Local Settings\temp\SVI3.TMP 
C:\Documents and Settings\DANIE\Local Settings\temp\SVLGM.TMP

FCopy::
C:\WINDOWS\ServicePackFiles\i386\ndis.sys | C:\WINDOWS\system32\dllcache\
C:\WINDOWS\ServicePackFiles\i386\ndis.sys | C:\WINDOWS\system32\drivers\

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the prvevious file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!