Search:

Do you still want to continue cleaning this computer? It's not even clear if it can be done.

The better and faster option is to back up your files, reformat the hard drive and reinstall Windows.

Do your copies of rkill and exehelper work?

That could work. Even better would be to rename the file before the download:

Please right click the following link aswMBR and select Save file as or...

Ok... both methods work on my computer.

Please double click the aswMBR icon on your desktop to verify that the program starts. Just close the program again.

Click Start -> Run..., type cmd into...

Does this work?

Click Start -> Run..., copy (including both double quotes) and paste the following line into the run box, then click OK:
"C:\Documents and Settings\adnott\Desktop\aswMBR.exe" -ap...

You may be immediately prompted to run the application, then you should immediately see the aswMBR window and the prompt to change the active partition.

Boot to safe mode, re-run rkill and then...

Safe mode is not required, but may be needed if the program does not start.

Let's try this, if asked to download definitions, then answer No:

Click Start -> Run..., copy (including both double quotes) and paste the following line into the run box, then click OK:...

Did Combofix alert you that it found Zero Access and needed to reboot?

The log you posted from aswMBR does not have the expected contents. What happened when you ran aswMBR as quoted...

Your computer seems to be infected with a variant of the TDSS Rootkit, also known as W32/Alureon, which installs itself on a hidden partition.

This particular version might not be fixable and in...

Let's postpone any use of GMER and take a closer look at the MBR:


aswMBR

Please download aswMBR and save it to your Desktop.

Double click aswMBR.exe to run it.
When asked if you want to...

Ok, please follow the instructions a gave in my previous post...

Please re-run rkill (no need to post the log).


Try this method to get Combofix to fully run:

Click Start -> Run..., copy and paste the following line into the runbox, then click OK:
combofix...

This is the "stages" I'm writing about:
http://www.pcc-services.com/windows/guide/guide-combofix2.jpg
Does Combofix not display any "Completed Stage_x", even in safe mode

Yes, the presence and correct contents of the c:\CF-RC.txt file would definitely confirm a successful recovery console install. You should also notice that a new option to start the recovery console...

Did Combofix stall before or after successfully installing the recovery console?


Right click on the Start button.
Select Explore from the menu.
Navigate to and find the following file and...

Please follow the instructions below:


Combofix

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is...

Hello...

It has been 2 days since my last post to you.
Do you still need help with this problem?
Do you need more time?
If you can't get Malwarebytes to work then tell me, there are...

Delete File

Please refer to the following post and then delete dvd xcopy platinum with crack.zip:
http://forums.spybot.info/showpost.php?p=25290&postcount=4

Right click on the Start button.
...

Did you download HijackThis?
Did you save it to the C:\Program Files\Trend Micro\HiJackThis folder?
Before or after you ran the RSIT scan?

That looks correct.

It's not clear to me if the computer is used for private or business related activities at work. Please clarify.

Just download HijackThis to that folder, don't run it.

Private use at work? :laugh:

I'm sorry for the delay.

The wireless dropping is likely caused by the infection.

Are you using this computer for any business related activities?

Re-run rkill before following the...

Since you were never given a Windows Product Key and Windows was deactivated by Combofix, it is likely that the built in activation system has been tampered with and that the Windows install on the...

Download/run Rkill:

Please download Rkill from the following link and save it to your Desktop:

Rkill


Double click on Rkill.
A command window will open then disappear upon completion,...

Hello.

My nickname is vict0r and I will help you with the malware issues on your computer.

Please read the following information carefully.

IMPORTANT: Whatever repairs we make, are for...

Ok, power down the computer:
Type the command exit, then press the Enter key. The computer will reboot.
Press the up arrow key on the keyboard as soon as the black screen is displayed during the...

Please note that the word type is part of the command. You must type 'type C:\Qoobox\ComboFix-quarantined-files.txt' without the single quotes.

The command is the line in the box below:

type C:\Qoobox\ComboFix-quarantined-files.txt

Are there more files listed by the following command?
type C:\Qoobox\ComboFix-quarantined-files.txt

Also, don't forget to answer my questions about the Windows product key:

There seems to be no "/p"-parameter in the recovery console. This is the command I prefer you to try:
dir c:\Qoobox\Quarantine\c\windows\system32
Post back with 10 files from the bottom.

You can also try this:
dir c:\Qoobox\Quarantine\c\windows\system32

Try the following command, make sure you spell it correctly:
type C:\Qoobox\ComboFix-quarantined-files.txt
If successful post back 10 entries in that file starting from the bottom.

Do anyone of these work?
dir c:\Qoobox
dir c:\
dir

Try the following command:
dir /s /p c:\Qoobox\Quarantine\c\windows\system32
Note that there are 3 spaces in the command.

Regarding your Windows Product key: Where is it? Did you stick it inside the computer case or do you store it elsewhere?

You may want to print out these instructions.

Enter the Recovery...

http://4windows.net/wp-content/uploads/2011/03/Windows-XP-activation-fix.jpg


http://i2.squidoocdn.com/resize/squidoo_images/-1/draft_lens2267816module12389736photo_12255123262.JPG

Please...

What happens if you start the computer in safe mode? Do you get blocked by the Activation wizard or are you allowed to reach the desktop?

Do you remember if Combofix successfully installed the...

That should not happen.

I need to do more research before I can get back to you on the issue. I have some questions and your answers may help me in my research:
Which make and model is this...

Go ahead and run Combofix. Remember to install the recovery console.

Ok. Trend Micro is probably not running in safe mode. Go ahead and run Combofix. You will be alerted if it detects an active anti-virus.

Please start your computer in safe mode with networking.

Download ComboFix

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix...

If you do not follow the instructions exactly as given, it will complicate the process and cause significant delays. All scans and fixes must be run only once if not specifically requested.

It's...

Yes, please. Start the computer in safe mode with networking and access this topic to download the programs. Do not use a usb stick or similar to transfer files to your existing computer.

Please run the scans below and post the logs. Please use one reply per log.

CKScanner

Please download CKScanner ... Save it to your desktop.
This program should only be run once!
Make sure...

Hello.

My nickname is vict0r and I will help you with the malware issues on your computer.

Please read the following information carefully.

IMPORTANT: Whatever repairs we make, are for...

Install Various Common Programs

Here follows instructions to install various common programs. Please do not install a program you don't need. Make sure you read the prompts during the installation...

It appears to me that you have experience with hard drive swapping and that you know how to minimize the risk of damaging static discharge while swapping internal components of a computer.

Using a...

There's a bump in the road again.

Do you have any experience in how to swap out internal components of a computer? Do you know how minimize the risk of static discharge while working with...

At this point it's still not clear what remaining malware threats that may still reside on this computer. Given the nature of any rootkit infection, it is impossible to know all the changes that may...

This will minimize the risk of bringing any infection with you to the fresh install:

In addition to exe-files, you should generally not backup any html-files. Run a online virus scan on the backup...