Options

nexplore and other spyware keep popping up

Unknown
edited August 2009 in Spyware & Virus Removal
hi i just bought a laptop from a friend and we dont got cd's to refortmat so i just changed everything my way and now only problem i got is internet explorer keeps opening nexplore and stopzilla ads and sometimes my mozilla search goes thru find a bargain? and then says error no searches show up THANKS for all your HELP what logs do you need me to show you SORRY IM NEW :confused:

Comments

  • ph1ogic
    edited August 2009
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:24:36 AM, on 8/23/2009
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18813)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Windows\system32\rundll32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
    O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
    O20 - AppInit_DLLs: C:\Windows\System32\dinput832.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PCPitstop Scheduling - PC Pitstop LLC - C:\Program Files\PCPitstop\PCPitstopScheduleService.exe
    O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

    --
    End of file - 3837 bytes
  • chiazchiaz
    edited August 2009
    Hey there, welcome. :)

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log, C:\ComboFix.txt as well as a new HijackThis log for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • ph1ogic
    edited August 2009
    Malwarebytes' Anti-Malware 1.40
    Database version: 2702
    Windows 6.0.6002 Service Pack 2

    8/27/2009 12:20:44 AM
    mbam-log-2009-08-27 (00-20-44).txt

    Scan type: Quick Scan
    Objects scanned: 87161
    Time elapsed: 4 minute(s), 22 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 2
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 2
    Folders Infected: 0
    Files Infected: 2

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\Windows\System32\dinput832.dll (Worm.P2P) -> Delete on reboot.
    C:\Users\the hand of god\AppData\Local\Temp\E126.tmp (Trojan.Agent) -> Delete on reboot.

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Worm.P2P) -> Data: c:\windows\system32\dinput832.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Worm.P2P) -> Data: system32\dinput832.dll -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Windows\System32\dinput832.dll (Worm.P2P) -> Delete on reboot.
    C:\Users\the hand of god\AppData\Local\Temp\E126.tmp (Trojan.Agent) -> Delete on reboot.

    ======================
    ComboFix 09-08-26.05 - the hand of god 08/27/2009 0:28.1.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1900 [GMT -7:00]
    Running from: c:\users\the hand of god\Downloads\ComboFix.exe
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\$recycle.bin\S-1-5-21-441297808-2901947475-1971349757-1000
    c:\users\Guest\AppData\Roaming\020000005268093e598C.manifest
    c:\users\Guest\AppData\Roaming\020000005268093e598O.manifest
    c:\users\Guest\AppData\Roaming\020000005268093e598P.manifest
    c:\users\Guest\AppData\Roaming\020000005268093e598S.manifest
    c:\users\the hand of god\AppData\Roaming\020000005268093e598C.manifest
    c:\users\the hand of god\AppData\Roaming\020000005268093e598O.manifest
    c:\users\the hand of god\AppData\Roaming\020000005268093e598P.manifest
    c:\users\the hand of god\AppData\Roaming\020000005268093e598S.manifest
    c:\windows\system32\dSzg4IZgqsxAs.vbs

    .
    ((((((((((((((((((((((((( Files Created from 2009-07-27 to 2009-08-27 )))))))))))))))))))))))))))))))
    .

    2009-08-27 07:14 . 2009-08-27 07:14
    d
    w- c:\users\the hand of god\AppData\Roaming\Malwarebytes
    2009-08-27 07:14 . 2009-08-03 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-27 07:14 . 2009-08-27 07:14
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-27 07:14 . 2009-08-27 07:14
    d
    w- c:\programdata\Malwarebytes
    2009-08-27 07:14 . 2009-08-03 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-26 04:24 . 2009-08-26 04:24
    d
    w- c:\users\the hand of god\Office Genuine Advantage
    2009-08-26 03:21 . 2009-08-26 03:21
    d
    w- C:\D2LOD-1.12A-enUS
    2009-08-26 03:20 . 2009-08-26 03:20
    d
    w- C:\D2-1.12A-enUS
    2009-08-26 03:02 . 2009-08-26 03:02
    d
    w- C:\SC-1.15.2-enUS
    2009-08-26 02:57 . 2009-08-26 02:57
    d
    w- c:\programdata\Office Genuine Advantage
    2009-08-26 01:48 . 2009-06-22 10:09 2048 ----a-w- c:\windows\system32\tzres.dll
    2009-08-26 01:47 . 2009-06-05 09:53 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2009-08-26 01:47 . 2009-06-05 09:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2009-08-24 06:17 . 2009-08-25 07:57
    d
    w- c:\users\the hand of god\AppData\Local\Microsoft Games
    2009-08-23 18:22 . 2009-08-23 18:22
    d
    w- c:\program files\Trend Micro
    2009-08-23 03:29 . 2009-08-23 03:29
    d
    w- c:\windows\system32\ca-ES
    2009-08-23 03:29 . 2009-08-23 03:29
    d
    w- c:\windows\system32\eu-ES
    2009-08-23 03:29 . 2009-08-23 03:29
    d
    w- c:\windows\system32\vi-VN
    2009-08-23 03:18 . 2009-08-23 03:18
    d
    w- c:\windows\system32\EventProviders
    2009-08-23 03:11 . 2009-08-23 03:11
    d
    w- c:\program files\CCleaner
    2009-08-23 02:32 . 2009-08-27 07:26
    d
    w- c:\programdata\PCPitstop
    2009-08-23 02:32 . 2009-08-23 02:32
    d
    w- c:\program files\PCPitstop
    2009-08-23 02:24 . 2009-08-23 02:24
    d
    w- c:\program files\iPod
    2009-08-23 02:24 . 2009-08-23 02:24
    d
    w- c:\program files\iTunes
    2009-08-23 02:22 . 2009-08-23 02:23
    d
    w- c:\program files\QuickTime
    2009-08-23 02:16 . 2009-08-23 02:16 75040 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
    2009-08-23 01:47 . 2009-08-23 01:47
    d
    w- c:\users\the hand of god\AppData\Local\Apple
    2009-08-23 00:17 . 2009-08-23 00:17
    d
    w- c:\users\the hand of god\AppData\Local\Apple Computer
    2009-08-23 00:17 . 2009-08-23 00:17
    d
    w- c:\users\the hand of god\AppData\Roaming\Apple Computer
    2009-08-22 23:45 . 2009-08-23 03:48 54600 ----a-w- c:\users\the hand of god\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-08-21 20:05 . 2009-04-11 06:28 1017856 ----a-w- c:\windows\system32\wevtsvc.dll
    2009-08-21 20:04 . 2009-04-11 06:28 29184 ----a-w- c:\windows\system32\uxsms.dll
    2009-08-21 19:49 . 2009-08-21 19:49
    d
    w- c:\users\the hand of god\AppData\Local\quicktime
    2009-08-21 19:49 . 2009-08-21 19:49
    d
    w- c:\users\the hand of god\AppData\Local\META-INF
    2009-08-21 19:49 . 2009-08-21 19:49
    d
    w- c:\users\the hand of god\AppData\Local\com
    2009-08-21 19:49 . 2009-08-21 19:49
    d
    w- c:\users\the hand of god\AppData\Local\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    2009-08-21 19:41 . 2009-08-21 19:41
    d
    w- c:\users\the hand of god\AppData\Local\WindowsUpdate
    2009-08-21 19:35 . 2009-06-15 14:52 1259008 ----a-w- c:\windows\system32\lsasrv.dll
    2009-08-21 19:35 . 2009-06-15 14:52 499712 ----a-w- c:\windows\system32\kerberos.dll
    2009-08-21 19:35 . 2009-06-15 23:15 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2009-08-21 19:35 . 2009-06-15 14:54 175104 ----a-w- c:\windows\system32\wdigest.dll
    2009-08-21 19:35 . 2009-06-15 14:53 72704 ----a-w- c:\windows\system32\secur32.dll
    2009-08-21 19:35 . 2009-06-15 14:53 270848 ----a-w- c:\windows\system32\schannel.dll
    2009-08-21 19:35 . 2009-06-15 14:53 218624 ----a-w- c:\windows\system32\msv1_0.dll
    2009-08-21 19:35 . 2009-06-15 12:48 9728 ----a-w- c:\windows\system32\lsass.exe
    2009-08-21 19:08 . 2009-08-21 19:08
    d
    w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
    2009-08-21 19:08 . 2009-08-21 19:08
    d
    w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
    2009-08-21 19:04 . 2009-08-23 02:19
    d
    w- c:\programdata\Spybot - Search & Destroy
    2009-08-21 19:04 . 2009-08-23 02:19
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-08-21 18:54 . 2009-08-21 18:54
    d
    w- c:\users\the hand of god\AppData\Local\Toshiba
    2009-08-21 18:36 . 2009-08-21 18:36
    d
    w- c:\users\the hand of god\AppData\Roaming\acccore
    2009-08-21 18:36 . 2009-08-21 18:36
    d
    w- c:\users\the hand of god\AppData\Local\AOL OCP
    2009-08-21 18:36 . 2009-08-21 18:36
    d
    w- c:\users\the hand of god\AppData\Local\AOL
    2009-08-21 17:54 . 2009-08-21 17:54
    d
    w- c:\users\the hand of god\AppData\Local\Mozilla
    2009-08-21 07:23 . 2009-08-27 07:04
    d
    w- C:\Warcraft III
    2009-08-21 06:18 . 2009-08-21 07:24
    d
    w- c:\program files\Common Files\Blizzard Entertainment
    2009-08-21 06:01 . 2009-08-23 03:05
    d
    w- c:\programdata\Viewpoint
    2009-08-21 06:01 . 2009-08-21 06:01
    d
    w- c:\programdata\acccore
    2009-08-21 06:01 . 2009-08-21 06:03
    d
    w- c:\programdata\AOL OCP
    2009-08-21 06:01 . 2009-08-21 06:01
    d
    w- c:\programdata\AOL
    2009-08-21 06:01 . 2009-08-21 06:01
    d
    w- c:\program files\Common Files\AOL
    2009-08-21 06:01 . 2009-08-21 06:02
    d
    w- c:\program files\AIM6
    2009-08-21 06:00 . 2003-09-08 21:08 53760 ----a-w- c:\windows\uninst62.exe
    2009-08-16 17:33 . 2009-08-16 17:33 746760 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2009-08-14 00:37 . 2009-06-04 12:07 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-08-14 00:37 . 2009-04-11 06:28 53248 ----a-w- c:\windows\system32\tsgqec.dll
    2009-08-14 00:37 . 2009-04-11 06:28 136192 ----a-w- c:\windows\system32\aaclient.dll
    2009-08-13 23:06 . 2009-06-10 11:42 160256 ----a-w- c:\windows\system32\wkssvc.dll
    2009-08-13 23:06 . 2009-07-15 12:40 8147456 ----a-w- c:\windows\system32\wmploc.DLL
    2009-08-13 23:06 . 2009-07-15 12:39 313344 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-08-13 23:06 . 2009-07-15 12:39 4096 ----a-w- c:\windows\system32\dxmasf.dll
    2009-08-13 23:06 . 2009-07-15 12:39 7680 ----a-w- c:\windows\system32\spwmp.dll
    2009-08-13 23:01 . 2009-07-17 13:54 71680 ----a-w- c:\windows\system32\atl.dll
    2009-08-13 23:00 . 2009-06-10 11:38 91136 ----a-w- c:\windows\system32\avifil32.dll
    2009-08-03 22:07 . 2009-08-03 22:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
    2009-08-03 22:07 . 2009-08-03 22:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
    2009-08-03 22:07 . 2009-08-03 22:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-23 03:29 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Calendar
    2009-08-23 03:29 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-08-23 03:29 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Sidebar
    2009-08-23 03:29 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Photo Gallery
    2009-08-23 03:29 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Journal
    2009-08-23 03:29 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Collaboration
    2009-08-23 03:29 . 2006-11-02 12:37
    d
    w- c:\program files\Windows Defender
    2009-08-23 03:29 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
    2009-08-23 02:24 . 2009-05-18 22:27
    d
    w- c:\program files\Common Files\Apple
    2009-08-21 18:43 . 2009-05-15 02:44
    d
    w- c:\programdata\DVD Shrink
    2009-08-21 18:41 . 2009-05-16 02:33
    d
    w- c:\program files\LimeWire
    2009-07-21 21:52 . 2009-07-29 00:27 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-07-21 21:47 . 2009-07-29 00:27 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-07-21 21:47 . 2009-07-29 00:27 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-07-21 20:13 . 2009-07-29 00:27 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-06-15 14:53 . 2009-07-17 04:44 156672 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-15 14:52 . 2009-07-17 04:44 23552 ----a-w- c:\windows\system32\lpk.dll
    2009-06-15 14:52 . 2009-07-17 04:44 72704 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-15 14:51 . 2009-07-17 04:44 10240 ----a-w- c:\windows\system32\dciman32.dll
    2009-06-15 12:42 . 2009-07-17 04:44 289792 ----a-w- c:\windows\system32\atmfd.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
    "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @=&quot;Service"

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):a9,cb,dc,b1,a2,23,ca,01

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{54B216EA-A421-45F5-99AD-6A33BC0D3466}c:\\users\\system 1\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\qimps2ba\\digital-download[1].exe"= UDP:c:\users\system 1\appdata\local\microsoft\windows\temporary internet files\content.ie5\qimps2ba\digital-download[1].exe:digital-download[1].exe
    "UDP Query User{A415404F-93F3-43A1-AE48-401187463CE7}c:\\users\\system 1\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\qimps2ba\\digital-download[1].exe"= TCP:c:\users\system 1\appdata\local\microsoft\windows\temporary internet files\content.ie5\qimps2ba\digital-download[1].exe:digital-download[1].exe
    "{D85FC262-638B-45E1-8537-3E74B3326A87}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{0EE21B73-6F44-4438-A87F-35CA1581D061}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{464E9404-F4D7-49D8-B539-AE32C3AE9CF2}"= UDP:c:\program files\AIM6\aim6.exe:AIM
    "{586A6F5F-B4A2-490D-A460-418D536F52B9}"= TCP:c:\program files\AIM6\aim6.exe:AIM
    "TCP Query User{3AD66892-729F-4590-ABBD-E49E860CDAD6}c:\\warcraft iii\\war3.exe"= UDP:c:\warcraft iii\war3.exe:Warcraft III
    "UDP Query User{7F1BC6B7-4660-43B2-A215-01FFF0E17A97}c:\\warcraft iii\\war3.exe"= TCP:c:\warcraft iii\war3.exe:Warcraft III
    "TCP Query User{E0C991AB-AF75-4BE3-BE4C-FF2D0DD8D9DA}c:\\warcraft iii\\war3.exe"= UDP:c:\warcraft iii\war3.exe:Warcraft III
    "UDP Query User{486A418C-3052-440C-937F-2BD3991BAA8F}c:\\warcraft iii\\war3.exe"= TCP:c:\warcraft iii\war3.exe:Warcraft III
    "{204B2C18-114C-4732-A93B-20EE3D59205A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
    "{86DD233E-B569-44AB-AC81-2E554D69F1B3}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
    "TCP Query User{06B772D4-216A-4A24-8FA3-32370AA0F262}c:\\users\\the hand of god\\downloads\\downloader_starcraft_combo_enus.exe"= UDP:c:\users\the hand of god\downloads\downloader_starcraft_combo_enus.exe:downloader_starcraft_combo_enus.exe
    "UDP Query User{C80B628A-9F1A-4139-B7C5-E774C69FC0BD}c:\\users\\the hand of god\\downloads\\downloader_starcraft_combo_enus.exe"= TCP:c:\users\the hand of god\downloads\downloader_starcraft_combo_enus.exe:downloader_starcraft_combo_enus.exe
    "TCP Query User{6696A413-B92F-4295-B523-CBF523625983}c:\\users\\the hand of god\\downloads\\downloader_diablo2_enus.exe"= UDP:c:\users\the hand of god\downloads\downloader_diablo2_enus.exe:downloader_diablo2_enus.exe
    "UDP Query User{D77BF269-CC39-4CFB-95A0-A8F5BE0949EB}c:\\users\\the hand of god\\downloads\\downloader_diablo2_enus.exe"= TCP:c:\users\the hand of god\downloads\downloader_diablo2_enus.exe:downloader_diablo2_enus.exe
    "TCP Query User{DB064A2F-1CA1-4456-8D85-55A4EBE1F81D}c:\\users\\the hand of god\\downloads\\downloader_diablo2_lord_of_destruction_enus.exe"= UDP:c:\users\the hand of god\downloads\downloader_diablo2_lord_of_destruction_enus.exe:downloader_diablo2_lord_of_destruction_enus.exe
    "UDP Query User{C0ED2E59-F1EC-414F-8264-AC9F2343544D}c:\\users\\the hand of god\\downloads\\downloader_diablo2_lord_of_destruction_enus.exe"= TCP:c:\users\the hand of god\downloads\downloader_diablo2_lord_of_destruction_enus.exe:downloader_diablo2_lord_of_destruction_enus.exe
    "TCP Query User{650E5B23-0FA9-4A0D-9408-3DDE83656FA8}c:\\users\\the hand of god\\downloads\\downloader_starcraft_combo_enus(2).exe"= UDP:c:\users\the hand of god\downloads\downloader_starcraft_combo_enus(2).exe:downloader_starcraft_combo_enus(2).exe
    "UDP Query User{0291B4E8-F7CC-44AA-8449-DF7EF5E055AF}c:\\users\\the hand of god\\downloads\\downloader_starcraft_combo_enus(2).exe"= TCP:c:\users\the hand of god\downloads\downloader_starcraft_combo_enus(2).exe:downloader_starcraft_combo_enus(2).exe

    R2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [4/17/2008 12:19 AM 40960]
    R2 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [8/22/2009 7:32 PM 90352]
    R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [5/15/2009 10:50 AM 7168]
    R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [11/17/2008 3:40 PM 3668480]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\System32\drivers\motccgp.sys [8/21/2008 11:49 PM 18688]
    S3 motccgpfl;MotCcgpFlService;c:\windows\System32\drivers\motccgpfl.sys [8/21/2008 11:49 PM 8320]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-27 c:\windows\Tasks\User_Feed_Synchronization-{37AD10BF-88A7-49EC-B592-E645FDB9181F}.job
    - c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Aim6 - (no file)


    .
    Supplementary Scan
    .
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    FF - ProfilePath - c:\users\the hand of god\AppData\Roaming\Mozilla\Firefox\Profiles\kytf8xrk.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.whiskeymilitia.com/
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-27 00:34
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\users\THEHAN~1\AppData\Local\Temp\catchme.dll 53248 bytes executable

    scan completed successfully
    hidden files: 1

    **************************************************************************
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    Completion time: 2009-08-27 0:37
    ComboFix-quarantined-files.txt 2009-08-27 07:37

    Pre-Run: 250,359,156,736 bytes free
    Post-Run: 250,310,012,928 bytes free

    254 --- E O F --- 2009-08-26 01:49
    =================================
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:24:36 AM, on 8/23/2009
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18813)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Windows\system32\rundll32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
    O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
    O20 - AppInit_DLLs: C:\Windows\System32\dinput832.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PCPitstop Scheduling - PC Pitstop LLC - C:\Program Files\PCPitstop\PCPitstopScheduleService.exe
    O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

    --
    End of file - 3837 bytes

    <3
  • chiazchiaz
    edited August 2009
    I need a new HijackThis log. The one you just posted was saved on 8/23/2009.

    Also how's your PC running at this point in time?
  • ph1ogic
    edited August 2009
    chiaz wrote:
    I need a new HijackThis log. The one you just posted was saved on 8/23/2009.

    Also how's your PC running at this point in time?

    MUCH BETTER AM I ALL DONE?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:19:36 AM, on 8/27/2009
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18813)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Windows\Explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PCPitstop Scheduling - PC Pitstop LLC - C:\Program Files\PCPitstop\PCPitstopScheduleService.exe
    O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

    --
    End of file - 2696 bytes
  • chiazchiaz
    edited August 2009
    I think our work is done here - your PC should be clean now.

    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.


    Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks. :)
  • ph1ogic
    edited August 2009
    chiaz wrote:
    I think our work is done here - your PC should be clean now.

    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.


    Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks. :)

    archived!
  • chiazchiaz
    edited August 2009
    Glad we could be of assistance! This topic is now closed.

    If I have helped you, please consider making a personal donation (Paypal) to me at parasite[AT]parasitedb.com.
    To support Icrontic, click here:
    http://icrontic.com/support
    Donations are entirely voluntary in nature and will have no bearing on the future help that you may receive.

    If you wish to reopen your topic, please send a Private Message (PM) to Trogan or me with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
Sign In or Register to comment.