Infection on comp

[adam]

win xp sp3

hi guys hope you can help me with this or a complete reinstall will have to be done, my comp has been infected have just run a full scan and the detected items can not be removed/quaranted.

i have attached the report hope this helps pls advice if you can,

[adam]

apologies for not reading the instructions fully before here are logs from new scan etc.

I have a round red with white cross windows style button that has appeared in the bottom right of my task bar that i can not left click on but if i hover my mouse over it a pop up box appears that states

"Your computer is infected

windows has detected spyware infection!

It is recomended to use special antispyware tools to prevent

data los. Windows willnow download and install the most

up-to-date antispyware for you.

click here to protect your computer from spyware"

this also pops up every few minutes

cant seem to find the log from i seeyouxp will have a read through some posts here for info and will post it asap

[adam]

hope one of those is the right one

[ShadowPuterDude]

hope one of those is the right one

Neither one of those are the ISeeYouXP log. The log file should be on your Desktop.

[adam]

thought you would say that, but its not there even though the path says it should be i have copied and pasted it to a word doc hope that is ok. (not allowed to attach that type of doc)

so any ideas on how i can sort out the report location??

[ShadowPuterDude]

Files with the doc extension are disallowed.

Download ComboFix from one of these locations:

Link 1

Link 2

Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  See HERE for help
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, ComboFix will produce a log.

Note:

1. Do not mouseclick combofix's window while it's running. That may cause it to stall!

2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

-----------------------------------------------------------

Post fresh logs for:

• ComboFix (C:\combofix.txt)
  
• ISeeYouXP
  
• HiJackFree

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

[adam]

ok here are latest reports

still cant get the iseeuxo one sadly, the red circle dissapeared from my task bar as soon as i run combofix.

all seems to be ok unless you find something else in logs.

thanks very much for the quick response and the fantastic help i will definatly be buying the full version of A2 from emsi.

[ShadowPuterDude]

OK, since we can't get a log from ISeeYouXP do the following:

Download OTL to your desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
    
  • Attach both logs with your next reply.
    

[adam]

The extras file was to big to upload is message im getting

[ShadowPuterDude]

Zip extras.txt and attach the zip file.

[adam]

here is zip file as requested

[ShadowPuterDude]

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  

  :OTL
  PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
  
  :Files
  C:\WINDOWS\System32\*.tmp
  C:\WINDOWS\*.tmp
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [Reboot]

  
  

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot when it is done
  
• Attach the new OTL log ( don't check the boxes beside LOP Check or Purity this time )
  

[adam]

here is log file as requested

[ShadowPuterDude]

You logs look fine. How are things working?

[adam]

everything seems to be working ok thanks

your help is much appreciated and hopefully i will not be saying hi to you soon

[ShadowPuterDude]

Unless you are having problems from Malware it is time to do the final steps.

If you used ComboFix, uninstall ComboFix:

• Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.)
  
• AvoidTDSS /u or combofix /u
  Note: The space before /u, must be there.
  This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  
• Delete the C:\AvoidTDSS or C:\ComboFix folder from combofix.
  Delete everything in C:\!KillBox

Delete the following from your Desktop (If they exist)

Avenger.exe

Avenger.txt

Avenger.zip

DisableAutoRuns.reg

FixMe.reg

FixReg.reg

ISeeYouXP.exe

ISeeYouXP.lnk

ISeeYouXP.txt

Anything else I had you use

Delete the following: (If they exist)

C:\Avenger.txt

C:\Avenger

C:\ComboFix.txt

C:\ComboFix

C:\SDFix

C:\Qoobox

You can delete and uninstall any programs I had you download, that you do not wish to keep on the system.

Empty the Recycle Bin

Run ATF Cleaner

In the ISeeYouXP folder double-click HideIT.bat.

Turn off System restore to flush all your restore points then turn system restore back on.

To manually turn off System Restore, follow these steps:

1. Click Start, right-click My Computer, and then click Properties.

2. Click the System Restore tab.

3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

4 Click Yes when you receive the prompt to the turn off System Restore.

To turn on System Restore, follow these steps:

1. Click Start, right-click My Computer, and then click Properties.

2. Click the System Restore tab.

3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

Delete C:\ISeeYouXP

Run Windows Update and update your Windows Operating System.

Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated.

That should take care of everything.

Safe Surfing!

[ShadowPuterDude]

Thread Closed

Reason: Resolved

The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread