Letters were entered by themselves

Comments

• chiaz

  December 2009 edited December 2009

  Hey there.
  
  A few things before we start....
  1. Please Read All Instructions Carefully.
  2. If you don't understand something, stop and ask! Don't keep going on.
  3. Please do not run any other tools or scans whilst I am helping you.
  4. If you have to go away for an extended period of time, let me know.
  5. Please continue to respond until I give you the "All Clear".
  (Just because you can't see a problem doesn't mean it isn't there)
  
  
  
  Please download Malwarebytes' Anti-Malware by clicking the link below:
  http://www.besttechie.net/tools/mbam-setup.exe
  
  Double Click mbam-setup.exe to install the application.
  
  * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  * If an update is found, it will download and install the latest version.
  * Once the program has loaded, select "Perform Quick Scan", then click Scan.
  * The scan may take some time to finish,so please be patient.
  * When the scan is complete, click OK, then Show Results to view the results.
  * Make sure that everything is checked, and click Remove Selected.
  * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  * You'll be required to post the contents of this log later.
  
  Please Note:
  If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
  
  
  
  Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:
  
  Go here ======> A guide and tutorial on using ComboFix <====== Go here
  
  Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.
  
  The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
  
  Once installed, you should get a prompt that says:
  
  The Recovery Console was successfully installed.
  
  Please continue as follows:
  
  (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  (2) Click Yes to allow ComboFix to continue scanning for malware.
  
  When the tool is finished, it will produce a report for you.
  
  
  Please include the MBAM log, C:\ComboFix.txt as well as a new HijackThis log for further review, so that we may continue cleansing the system.
  
  
  Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  Thanks for helping out. Here are the logs.
  
  I might add that it seems ComboFix changed something, as after I restarted the computer having scanned it, a few new start-up programs were detected by WinPatrol.
  
  ComboFix never asked me about anything, it just went on with its business.

  mbam-log-2009-12-06 (00-16-18).txt 949B

  ComboFix.txt 18.9K

  hijackthis.txt 8.2K

  0
• chiaz

  December 2009 edited December 2009

  Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
  
  It's IMPORTANT to carry out the instructions in the sequence listed below.
  
  
  First, please run HijackThis and place a tick by the following entries:
  O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
  O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
  O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
  
  
  Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis and restart the computer.
  
  =========================
  
  Next,
  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  Open *notepad* and copy/paste the text in red in the quotebox below into it:
  

  [COLOR="red"]File::
  c:\windows\system32\E465.tmp
  Registry::
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
  "ImagePath"=-[/COLOR]
  

  
  Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.
  
  
  
  
  Refering to the picture above, drag CFScript.txt into ComboFix.exe
  
  
  When finished, it shall produce a log for you at C:\ComboFix.txt
  
  Please copy and paste the ComboFix.txt in your new reply, along with a fresh HijackThis log.
  
  *Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in any way could damage your computer.*

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  Ok, here are the new logs.

  hijackthis.txt 8K

  ComboFix.txt 17.8K

  0
• chiaz

  December 2009 edited December 2009

  OK....let's have you go HERE to run Panda ActiveScan 2.0

  • Click the big green Scan now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • Once the scan is completed, please hit the notepad icon next to the text Export to:
  • Save it to a convenient location such as your Desktop
  • Post the contents of the ActiveScan.txt in your next reply, as well as let me know how your PC is running now.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  Here is the log from Panda. Please note that I had deliberately de-activated my antivirus during the scan.
  
  As for the computer, it seems pretty alright. Though it also seems that Comodo sometimes do not give the "warning box" whenever I connect to the network that gives me Internet access, as it used to always do. There is also a program called Services.exe that sometimes wants to change something in the registry, and according to Comodo, that particular demand is unusual. This has been occurring since I ran ComboFix.

  ActiveScan.txt 2.4K

  0
• chiaz

  December 2009 edited December 2009

  Do you have the full file path of this Services.exe?

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  C:\WINDOWS\System32\services.exe
  
  The keys it has been wanting to modify are HKLM\SYSTEM\ControlSet001\Services\tunnel\Type and HKLM\SYSTEM\ControlSet001\Services\TrustedInstaller\Start

  0
• chiaz

  December 2009 edited December 2009

  That filepath seems OK to me, but just to be sure, can you go to Jotti and scan the file:
  http://virusscan.jotti.org/en
  
  Other than that, is your PC running OK?

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  I uploaded it to Jotti, and no scanner reported anything.
  
  Yes, the computer seems to work quite alright now. The earlier HJT logs reported nothing serious?

  0
• chiaz

  December 2009 edited December 2009

  I think our work is done here - your PC should be clean now.
  
  It's time to remove ComboFix.
  
  Go to to Start > Run
  Type in box
  
  combofix /uninstall
  
  Note: the space between the X and the /uninstall
  
  Press Enter.
  
  This command will:
  
  Delete the following:
  ComboFix and its associated files and folders.
  VundoFix backups, if present
  The C:\Deckard folder, if present
  The C:_OtMoveIt folder, if present
  
  Reset the clock settings.
  Hide file extensions, if required.
  Hide System/Hidden files, if required.
  Reset System Restore.
  
  
  Even if you have no more queries or problems, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  Thank you for helping. Just one minor issue: How do I get to "Run" in Windows Vista? It's not directly under the Start menu like in previous Windows versions.

  0
• chiaz

  December 2009 edited December 2009

  Press the 'Start Menu' at the bottom left of your screen.
  
  In the small search box directly above, type Run.
  
  Click on the Run program that appears as your search result.
  
  From there, you should be able to proceed with the instructions above.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  chiaz wrote:

  Press the 'Start Menu' at the bottom left of your screen.
  
  In the small search box directly above, type Run.
  
  Click on the Run program that appears as your search result.
  
  From there, you should be able to proceed with the instructions above.

  
  I tried it, but then I got an error message saying that Combofix is only for Windows XP and 2000. And it seems like my wallpaper background disappeared...

  0
• chiaz

  December 2009 edited December 2009

  Hmm that's strange...yours isn't a 64-bit Vista version right?
  
  Weird how it ran OK but now throws up this error when we want to remove the tool...let me know.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  chiaz wrote:

  Hmm that's strange...yours isn't a 64-bit Vista version right?
  
  Weird how it ran OK but now throws up this error when we want to remove the tool...let me know.

  
  No, my Vista is a 32 bits version.
  
  Yeah, it worked well when the cleaning was on.

  0
• chiaz

  December 2009 edited December 2009

  Sorry for the late response.
  
  Download a fresh copy, install it over and run it again. Then follow the instructions again to uninstall it.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  Ok. Should I run it with the script again, or once without and once with it, or just once without it?

  0
• chiaz

  December 2009 edited December 2009

  Once without it.

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  I tried that, and now even when I start it in the normal way, I get the error message that ComboFix is only for Windows 2000 and XP.

  0
• chiaz

  December 2009 edited December 2009

  In that case, just remove the ComboFix file. Any other issues?

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  Sorry for my slight absence.
  
  It seems like ComboFix messed up some image things. For instance, if I create a folder and put only images in it, it no longer shows minor images as a broschure when the folder is viewed as an icon (i.e it is placed on the desktop).
  
  More importantly, I can't have any desktop background. The Windows ones are all gone, and it seems not to allow me to use custom images either. Right now the background is only black. Though before I sign in into my user account, the usual (non-changeable I think) background is there.

  0
• chiaz

  December 2009 edited December 2009

  Please download the latest version of Combofix.
  
  Disable all resident AV protection (Avira AntiVir) so it does not stop CF.
  
  After downloaded run the new version of combofix with the /uninstall argument. So if you downloaded it to the C:\ drive, you would run:
  
  C:\combofix.exe /uninstall

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  I've tried that, including entering the exact location of CF, even if it was just at the desktop. It still only turns out the compability error message.
  
  It all seems rather strange, given that it worked to do the original scanning, but even that doesn't work anymore, because it (again) just turns out the compability error message.

  0
• chiaz

  December 2009 edited December 2009

  Give me a couple of days; I'll get the creator of ComboFix to look at this.
  
  Happy New Year!

  0
• Calypze Stockholm, Sweden

  December 2009 edited December 2009

  chiaz wrote:

  Give me a couple of days; I'll get the creator of ComboFix to look at this.

  
  Ok thank you.
  

  chiaz wrote:

  Happy New Year!

  
  You too.

  0