rmurphy

Use XP Pro -Ryan

I am not sure. I will post a message to the tool's creator and ask. -Ryan

Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed. Close any open browsers. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. ----------------------------------------------------------- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a sca

Go to Microsoft's website => http://support.microsoft.com/kb/310994 Select the download that's appropriate for your Operating System. Download the file & save it as it's originally named, next to ComboFix.exe. Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log. -Ryan

Welcome to BestTechie! I'm Ryan, and I'll be helping you clean your computer. Go to Microsoft's website => http://support.microsoft.com/kb/310994 Select the download that's appropriate for your Operating System. Download the file & save it as it's originally named, next to ComboFix.exe. Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the

Welcome to BestTechie! I'm Ryan, and I'll be helping you clean your computer. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the

Welcome to BestTechie! I'm Ryan, and I'll be helping you with your computer. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the

Welcome to BestTechie! I'm Ryan, and I'll be helping you clean your computer. Let's see if Malwarebytes' Anti-Malware will run. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is

Part 2 - Once you have submitted the file, follow the directions for using a cfscript again, using the following as the script: How is your computer running? -Ryan

Part 1 - Part 2 is on the next page Please go to UploadMalware to upload a suspicious file for analysis. Enter your username from this forum Copy and paste the link to this thread In the files to submit, paste the following in the first box: C:\WINDOWS\QnJva2VuZWFyeg\kBLSuZpRtqIVy0.vbs In the second box, paste: C:\Program Files\Del.js In the comments, please mention that I asked you to upload this file Click on Send File

Please download ComboFix from Here or Here to your Desktop. 1. Please open Notepad Click Start , then Run Type notepad .exe in the Run Box. 2. Now copy/paste the entire content of the codebox below into the Notepad window: 3. Save the above as CFScript.txt 4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again. 5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply: Combofix.txt A new HijackThis log. -Ryan

The files it found were in quarantine folders. They pose no real risk there. -Ryan

Time for some housekeeping Click START then RUN Now type Combofix /u in the runbox and click OK The above procedure will: Delete the following: ComboFix and its associated files and folders. VundoFix backups, if present The C:\Deckard folder, if present The C:_OtMoveIt folder, if present [*] Reset the clock settings. [*] Hide file extensions, if required. [*] Hide System/Hidden files, if required. [*] Reset System Restore. Congratulations, your log is clean For information on how to protect yourself in the future, read Infection Prevention Do you have any other questions or co

Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. Whe

Wow, I've never seen it take so long. The log looks good. How is your computer running? -Ryan

== Remove Programs == Please go to Add/Remove Programs in the Control Panel, and remove the following programs Java 2 Runtime Environment, SE v1.4.2 Reboot your computer. == Install Latest Java == Please go to THIS page, and click on the Download link that is in the Java Runtime Environment (JRE) 6 section. Click the radio button next to Accept License Agreement after reviewing it. The page will refresh - this is normal. Download the Windows Offline Installation, Multi-language. You will want to save this to a location you will remember. Once it has finished downloading, double click it, and f

== Remove Programs == Please go to Add/Remove Programs in the Control Panel, and remove the following programs Java 2 Runtime Environment, SE v1.4.2 Reboot your computer. == Install Latest Java == Please go to THIS page, and click on the Download link that is in the Java Runtime Environment (JRE) 6 section. Click the radio button next to Accept License Agreement after reviewing it. The page will refresh - this is normal. Download the Windows Offline Installation, Multi-language. You will want to save this to a location you will remember. Once it has finished downloading, double click it, and f

Open HiJack This and scan. When it finishes, put an X in the box next to these following item(s) O2 - BHO: {26bac801-1f88-f69a-3844-78b4cf8176ea} - {ae6718fc-4b87-4483-a96f-88f1108cab62} - C:\WINDOWS\system32\xtnakpoi.dll (file missing) O2 - BHO: (no name) - {B1108B8A-2F4C-4B76-A4B0-22D6ED93C71F} - C:\WINDOWS\system32\jkkjk.dll (file missing) O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O20 - Winlogon Notify: khfcdcb - khfcdcb.dll (file missing) Close all open windows except for HiJack This and click fix checked. Reboot your computer. Please delete the copy of

Please post a new HiJack This log and let me know how your computer is running. -Ryan

It would be best if your friend posted a log so we can see what exactly is being dealt with. == Clear Temporary Files == Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Close all Internet Explorer, Firefox, and Opera windows before continuing. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Op

Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. Whe

Open HiJack This and scan. When it finishes, put an X in the box next to these following item(s) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) Close all open windows except for HiJack This and click fix checked. Reboot your computer. Please post a new HiJack This log, as well as an Uninstall list. To obtain an Uninstall list. Open HijackThis, click Config, click Misc Tools Click "Open Uninstall Manager" Click "Save List" (generates uninstall_list.txt) -Ryan

Please post a new HiJack This log and let me know how your computer is running. -Ryan

Please post a new HiJack This log and let me know how your computer is running. -Ryan

Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. Whe