Search:

Awesome thank you! everything is running well, no issues or performance lags. We have created a new restore point and cleaned previous as described above. I will run one more online scan later...

C:\System Volume Information\_restore{9A62BD57-DD76-458F-B33F-50B39932C7FF}\RP467\A0128724.lnk LNK/URL.B trojan
C:\System Volume...

Thank you! Good to know, will have that removed asap. Here is the requested log,


ComboFix 11-05-11.01 - Ash 11/05/2011 16:38:42.2.2 - x86
Microsoft Windows XP Professional ...

ComboFix 11-05-09.04 - Ash 10/05/2011 21:09:52.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1014.473 [GMT -6:00]
Running from: c:\documents and...

You bet! We are running smoothly and the error message is now gone during start up. Are we in the clear now or are there any final steps we should follow through on?

:cowboy:

A

Awesome, that worked and the error message is now gone. Thank you!
:rockon:

Thank you again. Here is the log,

SystemLook 04.09.10 by jpshortstuff
Log created at 19:21 on 04/05/2011 by Ash
Administrator - Elevation successful

========== regfind ==========

Searching...

Thank you :) Performance so far has been back to normal, with the exception of when I start up I get the following error message:

Error loading: C:\WINDOWS\oyavipej.dll
Specified file can not be...

C:\Documents and Settings\Ash\Application Data\C3B7CC607230956CA4AE70E68AFE1D84\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application
C:\Documents and Settings\Ash\Application...

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6491

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

02/05/2011 07:15:33...

aswMBR version 0.9.5.232 Copyright(c) 2011 AVAST Software
Run date: 2011-05-01 20:28:38
-----------------------------
20:28:38.515 OS Version: Windows 5.1.2600 Service Pack 3
20:28:38.515 ...

much thanks again, so appreciated. here is the requested log.

aswMBR version 0.9.5.232 Copyright(c) 2011 AVAST Software
Run date: 2011-05-01 16:08:45
-----------------------------
16:08:45.093 ...

Was unable to log in normally.. But safemode with networking allowed me to download and unzip tdss tool. Installation gets to 80÷ then windows encounters error and needs to abort installation....

Hi! Thank you for the help, I will attempt this within the hour and update how it went. Just a note that I was unable to log into the pc yesterday, I will try this in safe mode with networking.
...

I followed the instructions post, but my PC will not finish the DDS, no reports are populated. Spybot stops halfway through but I can see 2 entries of Virtumonde and 4 for Fraud.antimalwareDoctor.
...

Hi there,
I am not sure if this is a virus or a software issue. Everytime on start up I get "Windows is installing Roxio Media Manager" .. it doesnt install anything it just pops up over and over....

Fantastic massive thanks again for all your help, everything is running smoothly now and I think they have the tools to keep things up to date and clean :)

Thanks again!!!!!


Ash

sorry, here is the screenshot,

http://s259.photobucket.com/albums/hh307/city_glo/?action=view&current=shot.jpg

Hi, tks for the reply & the info, this is awesome.
I did have another pop-up from my anti-virus, is this concerning?

I took a screen shot,

<a...

:p:Ahh yes, that makes a lot of sense. Again thanks for the quick help, I am only in town until tomorrow and my parents are so happy I was able to fix up thier PC before taking off :)
Things are...

Thanks for the quick reply :)

Here is the scan results from Anti-Malware:

Malwarebytes' Anti-Malware 1.24
Database version: 1054
Windows 5.1.2600 Service Pack 2

12:10:22 PM 15/08/2008...

Hi Phil,
Thanks for the reply. I have updated the Java. Virus protection software keeps popping up unreadable memory, and other errors. Here is the SmitFraudFix report,

SmitFraudFix v2.336
...

Hi there,
I am attempting to help my parents clean up thier PC. Search & Destory found 72 infections and I have been able to clean most of them up but there are a few things that seem to be quite...

FANTASTIC, thank you a million times over. I followed the steps you listed above and .. really can't thank you enough.

The computer is running better than it has in a long time. It did randomly...

C:\WINDOWS\system32\ujjhyo.0ll
C:\WINDOWS\system32\vtareapy.0ll
C:\WINDOWS\system32\wdpsneiu.0ll
C:\WINDOWS\system32\wgfetqts.0ll
C:\WINDOWS\system32\wmcjytga.0ll...

ComboFix 08-07-20.A0 - Ashley 2008-07-22 9:51:36.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.624 [GMT -6:00]
Running from: C:\Documents and...

I was on my way out when uploading the logs and the combo fix log is so big it froze the pc. I will upload it in a few hours when I get home again. Thanks again for all the help..

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, July 22, 2008
Operating System: Microsoft Windows XP Home Edition...

Here is the first item:

File: pool.bin
Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: ...

Again, thank you SO much..


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:36:37 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00...

Hi, thanks so much for helping me out. Sorry for jumping ahead, I was losing functionality and panic'd a bit. I wasnt sure if I should turn off my current virus protection before running the logs,...

:oops:

I posted previously but realized from the "Before You Post" that since I added information afterwards, it is going to look like I am being helped. Sorry, my bad :(

Here is my HJT scan
...

CClean Installed Programs Report.

Adobe Flash Player ActiveX
Adobe Reader 7.0.8
Adobe Shockwave Player 11
Apple Mobile Device Support
Apple Software Update
BlackBerry Desktop Software 4.3...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:54:08 PM, on 7/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
...

OK I followed instructions closely, ran ComboFix but I am still infected.

Here is the combofix log:

ComboFix 08-07-14.2 - Ashley 2008-07-14 19:03:27.1 - NTFSx86
Microsoft Windows XP Home...

Needing help.. I have spent weeks trying to clean my pc. I read the before you post, and have done as requested. Search & Destroy found Virtumonde, but so did my Shaw Secure (F-Secure) and both could...