Requesting PC Help please

You did not allow MGTools.exe to run to completion. In the meantime:
* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
c:\windows\system32\runonceSrv.exe
c:\windows\system32\controlSrv.exe
c:\windows\system32\verclsidSrv.exe

Folder::
c:\documents and settings\sarah  oddi\Application Data\Dacuic
c:\documents and settings\sarah  oddi\Application Data\Xupi
c:\documents and settings\sarah  oddi\Application Data\Tuirla
c:\documents and settings\sarah  oddi\Application Data\Okzeub
c:\documents and settings\sarah  oddi\Application Data\Hesyo
c:\documents and settings\sarah  oddi\Application Data\Ytsi
C:\Documents and Settings\sarah  oddi\Application Data\Ozevk

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"{B5ECBF8A-403B-82F2-E918-2F821D3B5EC1}"=-

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

 

MGTools is still not running properly. Please see this thread: Using MGtools

In the mean time:

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
c:\windows\system32\taskmgrSrv.exe
c:\program files\Internet Explorer\iexploreSrv.exe
c:\windows\system32\svchostSrv.exe
c:\program files\microsoft\desktoplayer.exe
c:\documents and settings\sarah  oddi\Application Data\Zizuyf\fyiqm.exe
c:\documents and settings\Administrator\Start Menu\Programs\Startup\asmum.exe 
c:\documents and settings\Administrator\Start Menu\Programs\Startup\batuy.exe 
c:\documents and settings\Administrator\Start Menu\Programs\Startup\esdeli.exe 
c:\documents and settings\Administrator\Start Menu\Programs\Startup\ohaxa.exe 
c:\documents and settings\Administrator\Start Menu\Programs\Startup\suecif.exe 
c:\documents and settings\Administrator\Start Menu\Programs\Startup\veuzfu.exe
c:\documents and settings\Guest\Start Menu\Programs\Startup\liicga.exe 
c:\documents and settings\Guest\Start Menu\Programs\Startup\opika.exe 
c:\documents and settings\Guest\Start Menu\Programs\Startup\pusip.exe 
c:\documents and settings\Guest\Start Menu\Programs\Startup\umby.exe 
c:\documents and settings\Guest\Start Menu\Programs\Startup\ywnu.exe 
c:\documents and settings\Guest\Start Menu\Programs\Startup\yxxo.exe
c:\documents and settings\sarah  oddi\Start Menu\Programs\Startup\ucroup.exe

Folder::
c:\documents and settings\sarah  oddi\Application Data\Furya
c:\documents and settings\sarah  oddi\Application Data\Zizuyf
c:\documents and settings\sarah  oddi\Application Data\Lifey

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{B5ECBF8A-403B-82F2-E918-2F821D3B5EC1}"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

 

Please immediately do the below. You must do this immediately and you must complete all 3 scans one after the other with only the delay to post logs in between. DO NOT use your PC for anything else but these instructions.

Run this Using ESET's Online Scanner and immediately attach the log.

Then run the Eset scan a second time and attach the 2nd log.

Then run the Eset scan a third time and attach the 3rd log.

After attaching the 3rd log, if any Ramnet infections were found by Eset, try to repeat the above until it comes up clean. The only infections of Ramnet you can ignore, are ones that may be found in the System Volume Information folder which is System Restore and cannot be cleaned. We will remove them later by disabling System Restore.

Then:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

 

Keep running the scans.

In the mean time, please delete ( uninstall ) these:
C:\Documents and Settings\sarah oddi\Local Settings\Temporary Internet Files\Content.IE5 --> empty it out!
C:\MGtools\
C:\Program Files\SUPERAntiSpyware

 

Keep running it as we are not making as much progress as I would hope. You may need to run it more than 3 times.

 

Run the scans back to back three at a time and then attach 3 x eset logs into a post.

Run three more back to back and attach those..
Keep going until ESET starts to find less and less.. remember:

 

This can be a very difficult virus to remove once it has taken hold. You need to keep running the eSet scan back to back. It is that or you will have to reformat and do a clean install.

 

Please disable system restore. Now see if you can find this folder:
C:\eff2b6b40e69c7820026e9f971eb9db2 --> delete it if you can.

Please re-run eSet again.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

 

Based on your latest log, it is time to throw in the towel. This virus has gotten too deeply embedded in your system to be able to clean it with any success. Your best course of action is to save your personal data and files to a cd and reformat your computer with a clean install. Then once you are back up and running, and well protected, scan your backup disc before you transfer the data and files back over.

 

Yes, you can do a clean install regardless of the message you are now getting. In order to do a clean install, you must first enter the bios ( F2 on some machines ) and set the boot order to allow the cd-rom the first boot device. Then put in your OS CD and reboot. Once it comes up you hit enter to "boot from CD". It will ask if you want to install or repair. Choose install. Then it will find the partition your previous install is on and you will want to format that partition. It is simple after that.