Virusburst & Others

Please use add/remove programs to uninstall:
MarketResearch

Use windows explorer to delete this folder:
C:\Program Files\Security Tools

Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8} - (no file)

After clicking Fix, exit HJT.

Now attach new logs for:

* GetRunKey
* ShowNew
* HJT

 

Try removing them in safe mode.....if that doesn't work:
Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.

Run HJT and fix the item ---
O2 - BHO: (no name) - {7A8F5B7A-A74F-495E-8A33-DF6226D2BAD8} - (no file)

Then do the registry patch.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

* Delete on Reboot
* then Click on the All Files button.*(or on the folders option)*
* Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\Security Tools

* Return to Killbox, go to the File menu, and choose Paste from Clipboard.
* Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Attach the requested logs.

 

Let's try Pocket Kill once again....only this time click on the files button and copy and paste these into it:

C:\Program Files\Security Tools\imsunst.exe
C:\Program Files\Security Tools\imsmn.exe
C:\Program Files\Security Tools\imsmain.exe
C:\Program Files\Security Tools\iesunst.exe
C:\Program Files\Security Tools\iesbunst.exe

Post the three logs again...(new runs of each.)

 

Make that two pints .....

Ok....before I leave for the day....

Use windows explorer to manually delete all the contents of that folder, one by one. (making sure you are logged in with an administrator account).

We may have to use Process Explorer to delete them.....let me know as I will check in later.

 

Are you still unable to access safe mode?

What pop ups -----> what do they say or refer to?

I'd like you to try running:
Download SDFix and save it to your Desktop.

• Run the SDFix.exe by double clicking on it.
• Allos it to install into the default location which is c:\SDFix
• Now please reboot your computer into Safe Mode (see this if you don't know how: Starting your computer in Safe mode )
• When you have booted into safe mode, open the C:\SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services or Registry entries found and then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
• Attach the Report.txt file to your next message.

 

Not knowing what was done by the IT dept. and the security folder still being present does make me wonder if you are really clean.

Are/is there anything in that folder? Plus I doubt that the registry key has been deleted:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run]
"rare"=-

Yes to running SDFix and attaching the log.
And I would like to see new logs for:
GetRun
ShowNew
HJT