Can't run spybot!

[debone]

Hi all, I hope you can help me with this!

I recently updated my antivirus software (AVG) and while the update was occuring for some reason the firewall dropped. I was browsing the internet at that time and then basically my computer starting going to crazy and flashing up all kinds of warning signs so I panicked and pulled the plug:oops:

Anyway, restrated, ran AVG and it picked up a couple of trojans and claimed to have cleaned them. I tried to run Spybot after this though and although the spybot.exe appears on the taskmanager list the program does not run. I tried to system restore but despite opening system restore it would not let me click on anything (i.e. couldn't choose a date, or even look back at the previous month).

I restarted again in safe mode and ran AVG again, this time it picked up some more things (which I thought may have just re-installed upon start up). The output AVG file read as follows -

\\?\globalroot\systemroot\system32\UACqqjkciyqxr.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\WINDOWS\system32\svchost.exe (616) Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\568907963392b6368ad1612b80b567\update\ Locked file. Not tested.
C:\7b57be48385b48e2e092ca0f\update\ Locked file. Not tested.
C:\bde97be67d9b4a7c37a9a28621da\update\ Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Administrator\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\Administrator\ntuser.dat.LOG Locked file. Not tested.
C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll Locked file. Not tested.
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\63acca2133954472b9dd8b539fa28a33_24adf822-76f7-4481-b30b-ff1b40f8687f Locked file. Not tested.
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Locked file. Not tested.
C:\pagefile.sys Locked file. Not tested.
C:\System Volume Information\ Locked file. Not tested.
C:\WINDOWS\system32\config\DEFAULT Locked file. Not tested.
C:\WINDOWS\system32\config\default.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SAM Locked file. Not tested.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SOFTWARE Locked file. Not tested.
C:\WINDOWS\system32\config\software.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SYSTEM Locked file. Not tested.
C:\WINDOWS\system32\config\system.LOG Locked file. Not tested.
D:\System Volume Information\ Locked file. Not tested.






And I still can't run Spybot (or combofix for that matter!). I assume I'm still infected and given that I'm a complete novice at this (and have probably caused more harm than good so far) I was hoping you helpl me,

Cheers,
DeBone

[Blade81]

Hi,

Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to your topic.



Download GMER (http://www.gmer.net) here by clicking download exe -button and then saving it your desktop:
Double-click .exe that you downloaded
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.