[Victim.]

The log for the ConboFix thing..

Doing the second part of your post now.

[evilfantasy]

Looking good. We may get away without running the Kaspersky scan

[Victim.]

Lmao, i hope so! The Dr.Web scan is 20% done so far so I'll be posting the other 2 logs you need soon.

OK - Done..

Dr.Web log contents:

rmcastnt.sys;c:\windows\system32\drivers;Program.E liteKeylogger.36;Renamed.;
videx.sys;c:\windows\system32\drivers;Program.Elit eKeylogger.36;Renamed.;
rsvpsvr.exe;C:\WINDOWS\system32;Program.EliteKeylo gger.36;Deleted.;
rmcastnt.#ys;C:\WINDOWS\system32\drivers;Program.E liteKeylogger.36;Incurable.Moved.;
videx.#ys;C:\WINDOWS\system32\drivers;Program.Elit eKeylogger.36;Incurable.Moved.;

Hijackthis log attached to post.

[evilfantasy]

Were you aware of the Keylogger?

The log looks fine now. Try The updates again and let me kno wthe exact error you get (if any)

[Victim.]

Yer, i did uninstall it but there were obviously files left over.

That Dr.Web program wasn't showing some buttons, but i think i still managed to do a full scan.

What updates?

[evilfantasy]

Weren't you having problems with Windows Updates?

[Victim.]

Yep, check my first post for more details.

[evilfantasy]

Ok, and the problem is still there after Combofix and Dr Web?

[Victim.]

Let me check..

Omg.. It's fixed!!

*Gives evil a cookie*

Thanks for the help!

[evilfantasy]

I was thinking it would be.


Time to do some cleanup and secure the work you have done.

• Click START then RUN
• Now type Combofix /u in the runbox
• Make sure there's a space between Combofix and /u
• Then hit Enter.

• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

Next

1. Double click OTMoveIt2.exe to launch it.
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)

• When finished exit out of OTMoveIt2

Learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Let me know how everything went.

[Victim.]

OK - Done all that now without a problem.

Think thats it?

Thanks for the help again.

[Howard]

I`m now marking this thread as solved.

If you need this thread re-opened please contact a moderator or PM me.

Regards Howard