[SamWatson]

hey guys

i am getting alot of iexplorer pop-ups, and when i shut my machine down, its says it waiting on iexplorer to finish, even though i use firefox.

i think my younger brother has downloaded somthing that has put some nasties on my PC..
he downloaded MSN Live Plus the other week, since then its been happening, i have removed the software.

ive attached a HJT file to the post


thanks in advance, and for reading

[Howard]

Hello and welcome to

Your system is infected with various malware and you`re running an outdated version of HJT.


Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as Attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard

This thread is for the use of SamWatson only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[tomrca]

hello and welcome samwatson, pleased to see that you took my advice.. you'll get good care here

[SamWatson]

ok, done all that, sorry it took so long we had a power cut.

logs are attasched, PandaAntirootkit found nothing
Online scanner found one item, do oyu want to to attach teh log that created?

AVG only found cookies, and could not quarentine them.

the two comdo fix logs you mention, (main.txt and extra.txt) do not exsist, i have combofix.txt and log.txt...

still getting pop-ups, and iexplorer is still runnign in proccesses


thanks again!

[Howard]

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\WINDOWS\system32\winrscpxd.ini

Folder::
C:\VundoFix Backups
C:\Documents and Settings\All Users.WINDOWS\Application Data\Joy coal mpeg heck
C:\DOCUME~1\SAM~1.SAM\APPLIC~1\BLAHCD~1

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Chin64"=-

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.



This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

Regards Howard

This thread is for the use of SamWatson only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[SamWatson]

ok, logs attached, thanks so much for your help

[Howard]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

First Acid.exe
lite save remote.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [mpeg heck log link] C:\Documents and Settings\All Users.WINDOWS\Application Data\Joy coal mpeg heck\First Acid.exe

O4 - HKCU\..\Run: [Chin64] C:\DOCUME~1\SAM~1.SAM\APPLIC~1\BLAHCD~1\lite save remote.exe

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\Documents and Settings\All Users.WINDOWS\Application Data\Joy coal mpeg heck<Delete the entire folder.
C:\DOCUME~1\SAM~1.SAM\APPLIC~1\BLAHCD~1<Delete the entire folder.

Click start/run and type regedit into the run box and press the enter key.

Navigate to the following reg keys and delete the bold portion.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\Chin64

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\mpeg heck log link

Close regedit.

Reboot into normal mode and rehide your protected OS files.

Post fresh HJT and Combofix logs.

Regards Howard

This thread is for the use of SamWatson only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[SamWatson]

the folders where not there

niehter were the regisrty values
i was not instructed to run Combofix, would you liek me to run it now for you? as you state to post a combo fix log.


HJT log attached

[Rik]

Originally Posted by howard_hopkinso

Post fresh HJT and Combofix logs.

Regards Howard

You were asked for a combofix log.




This thread is for the use of SamWatson only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[SamWatson]

my appologise

loog attached

[Howard]

Your HJT log is clean.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Blah cdrom

Close control panel.


Locate and delete the following bold files and/or folders(if there).

C:\Program Files\Blah cdrom<Delete the entire folder.
C:\Documents and Settings\Debra.SAM-BFW8UYNQ6YM\Application Data\Blah cdrom<Delete the entire folder.
C:\Documents and Settings\Joseph.SAM-BFW8UYNQ6YM\Application Data\Blah cdrom<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Post a fresh Combofix log.

Regards Howard

This thread is for the use of SamWatson only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[SamWatson]

ok, thanks you

log attached

[Howard]

That looks fine mate.

Click start/run and type combofix /u into the run box and hit the enter key. This will uninstall Combofix and all it`s folders etc.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

If you have no further questions could you please mark this topic Solved by going to the top of this thread and click Thread tools, then select Mark this thread as solved As seen in the image below:

If you need this thread re-opened please contact a moderator or PM me.


Regards Howard

This thread is for the use of SamWatson only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[SamWatson]

i just want to say a massive thanks.

you have helpped me out several times before. i hope i can return teh favour oneday!