Possible infection

[_Lee_]

same again, but this time It didn't alarm me about any anti-viruses running.

still got stuck on the same line:

[ken545]

Lee,

Have you tried running it in Safemode.

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
  this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
• Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode


If still a no go, drag Combofix to the trash and download a fresh copy but rename it like this.

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2







* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

[_Lee_]

I booted into safe mode with networking by using msconfig and tried to run combo-fix file,
but it got stuck on loading (even earlier than in normal mode).

[ken545]

Lee,

Drag CF to the trash and grab a fresh copy, rename it prior to downloading it.

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2







* IMPORTANT !!! Save ComboFix.exe to your Desktop

Then try to run it and if still wont run then do this and give it another try.


Open NOTEPAD.exe and copy/paste the text in the codebox below:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Eventlog]
"Start"=dword:00000004

Save this as fix.reg Choose to "Save type as - All Files"

Double click on fix.reg & allow it to merge into the registry

Reboot the machine once this is done and run combofix again.

[_Lee_]

did everything as was said in the instructions,
but got same message as in post #41
http://forums.spybot.info/showpost.p...5&postcount=41

[ken545]

Something on your system is preventing CF from running.

• Please download rkill (Courtesy of Bleepingcomputer.com).
• There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
• Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
• Note: You only need to get one of the tools to run, not all of them.

• 1. rkill.exe
  2. rkill.com
  3. rkill.scr
  4. WiNlOgOn.exe
  5. uSeRiNiT.exe

• Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.
  
  Run rkill repeatedly until it's able to do it's job. This may take a few tries.
  
  You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

Then try CF again, if it still wont run then another option is to completely uninstall both this programs
avast!, immunet

[_Lee_]

can rkill run while antiviruses are enabled?

[ken545]

Wouldn't hurt to disable them

[_Lee_]

I ran 2 of those rkill programms (antiviruses disabled and unluged internet cable), seemed to work, but combofix still gets stuck.

On monday I'll uninstall avast and immunet and will try again.

P.S. Log from rkill (while the program was running there was messages about some programms that can't be shout down, or requested downtime to be terminated in a unusual way, I don't remember exactly):

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 010.12.16. at 20:22:51.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:



Rkill completed on 010.12.16. at 20:23:08.

[ken545]

OK Lee,

Lets see what uninstalling both those programs will do.