Search:

I have read your last post. But I have not yet studied all the references.

As I aim to update my win, and my IE, in the next few days, I would appreciate if this thread would still be accessable...

cpuz132 was not installed by me, and speccy I have not heard of. I still find it strange to find it in my user local temp, which no longer exists. Malwarebytes removed a cpu.exe, maybe that is...

mbam log 22 jan

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5570

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

mbam log 16 jan.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5363

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

DDS


DDS (Ver_10-12-12.02) - NTFSx86
Run by Robert Prinsen at 15:30:42.17 on 22/01/2011
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.447.215...

Looking at DDS, the following entries puzzle me.

S3 cpuz132;cpuz132;\??\c:\docume~1\robert~1.tos\locals~1\temp\cpuz132\cpuz132_x32.sys -->...

Thank you for improving my system so tremendously.

I removed the directory c:\documents and settings\All Users\Application Data\gCkNc07000
I deinstalled Java 1.4 and reinstalled the latest...

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: TOSHIBA_MK8032GAX rev.AD002D -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

device:...

2011/01/21 19:01:31.0625 TDSS rootkit removing tool 2.4.14.0 Jan 18 2011 09:33:51
2011/01/21 19:01:31.0625 ================================================================================...

ComboFix 11-01-20.04 - Robert Prinsen 21/01/2011 18:21:01.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.447.129 [GMT 0:00]
Running from: c:\documents and settings\Robert...

I followed all the directions. Something called pev.cfxxe and pev.exe complined with software exceptions during the ComboFix stage and with TDSSKiller svchost had the same issue. :biggrinsmiley:

I...

svchost is still coming in and hogging the cpu.

One other problem I had with IExplorer has disappeared, and that is, it would not start properly, and I needed to register, which it could not do....

ComboFix 11-01-19.04 - Robert Prinsen 20/01/2011 22:51:16.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.447.136 [GMT 0:00]
Running from: c:\documents and settings\Robert...

GMER

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2011-01-20 18:18:51
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 TOSHIBA_MK8032GAX rev.AD002D
Running:...

I followed your instructions. I removed bittorrent, which I installed some six months ago, but never got working. Maybe just as well.

I re-downloaded combofix and renamed it pluuf.exe before...

AV Log



Avira AntiVir Personal
Report file date: 19 January 2011 21:22

Scanning for 2384044 virus strains and unwanted programs.

The program is running as an unrestricted full version.

Attach.txt


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device:...

DDS


DDS (Ver_10-12-12.02) - NTFSx86
Run by Robert Prinsen at 18:01:34.00 on 20/01/2011
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.447.138...

I followed your suggestions, and chose to install avira.

After installing Avira I ran the suggested First Scan. Nothing was detected, as there were no updates.

I rebooted with wireless...

I followed your suggestions, and chose to install avira.

After installing Avira I ran the suggested First Scan. Nothing was detected, as there were no updates.

I rebooted with wireless...

I hope this helps, my observations from the two DDS files are:-

(1) DDS: The objects that were added to my computer, and which no longer exist???
(2) Attach: The system resore I carried out to...

Norton is no longer current. I let that lapse. Sorry.
The host entry I inserted. It is another laptop in the house. All laptops are behind a wireless router.

Hello km2357, Thank you for taking the trouble to help me. I much appreciate it. Kind regards, Robert

gmer.log 01.16.2011 15:07
====================

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-16 15:07:14
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0...

Attach.txt 01.16.2011 13:41
=====================


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP...

DDS.txt 01.16.2011 13:41
===================


DDS (Ver_10-12-12.02) - NTFSx86
Run by Robert Prinsen at 13:39:05.29 on 16/01/2011
Internet Explorer: 7.0.5730.13
Microsoft Windows XP...

The malware was installed 9th January 2011, and started with a redirection to system tools. After removing the directory manually and also a vbs script l.vbs in ..\local settings\temp i have observed...