HiJack.startmenu and Hijack.taskmanager...please help

[lostcause]

I've read some of the post helping others get out of trouble with these types of virus. Please help me as I am clueless with these kind of stuff. The computer is locked up and I cannot even get on the internet so I cannot load OTL and other application that have been suggested. I can access the computer, but no view on desktop...all application erased on desktop. I was able to recover my taskmanager, though, but cannot get on the internet. Please help.

[Elise]

Would you be able to transfer tools using a flashdrive or CD to your problem computer?

[lostcause]

I have not tried that, but I can try that. Would you suggest downloading OTL, etc. onto one computer and load it to the affected computer. I will try that. Do I have to worry transferring back to the non-affected computer, using a flashdrive?

Thank you for reply.

[Elise]

To protect your clean computer, you can use Panda USB vaccine, this will prevent any malware from being able to spread to another computer using a removable drive: http://research.pandasecurity.com/panda-usb-and-autorun-vaccine/

[lostcause]

Thank you for the vaccine...I downloaded everything that was suggested on this post (http://forums.malwarebytes.org/index.php?showtopic=101670)

onto a flashdrive and follow the first step with the unhide.exe and was able to recover my desktop and startmenu...everything seems to be working okay as usual. Kinda concern because I did not do any other additional step that was recommended. What should I do now...should I continue with the OTL and TSSKiller as suggested? Just a little concern...don't know if the virus is still around on computer. Any further help would be great.

Thank you Elise025

[Elise]

Please run the following. Does the internet work on the computer?

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
    

  [*]Double click on the DDS icon, allow it to run.

  [*]A small box will open, with an explaination about the tool. No input is needed, the scan is running.

  [*]Notepad will open with the results.

  [*]Follow the instructions that pop up for posting the results.

  [*]Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

[lostcause]

Still cannot use the internet...I did a repair, but still no access to internet on the affected computer. Right now I am doing the Panda vaccine on the clean computer. I am downloading what you are suggesting and will move it over to affected computer with flashdrive...I can get what you need me to do but will take longer because of the flashdrive.

[lostcause]

It took more than 3 minutes...probably 10 minutes and after a blue screen appeared saying an error has occurred and I should restart computer and delete new installation of hardware or software...I did not copy what was written down for you...sorry, but my guest is the scan did not go thru.

[lostcause]

Again thank you for helping me...I was able to do the scan and there were 2 logs...I have attached both for you to see. Thank you...I will check the post tomorrow. Going to sleep...good nite.

dds.txt

attach.txt

[Elise]

Lets give the internet issue priority and fix that first. There is no active malware to be seen, but I suspect some remnants might be lurking.

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
    
  • Windows Update
    

  [*]Press "Scan".

  [*]It will create a log (FSS.txt) in the same directory the tool is run.

  [*]Please copy and paste the log to your reply.

[lostcause]

FSS1.txtFSS1.txtI did the scan...everything seems okay. Please see attached...

Just found out my wife locked me out of the internet and I was unable to get in...sorry led you in the wrong direction.

As of now, everything is working okay...do I have to worry about getting on the internet from here, even when everything checks out okay with your direction.

Thank you very much Elise025

[Elise]

Hello, I am glad to hear things are okay. Lets however check also for malware remnants.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

• 
  

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

[lostcause]

we have this CA security center we cannot disable...it has no option for CA personal firewall...what should I do. The combofix will not run unless I uninstall the CA security system. what should I do

[lostcause]

My computer does not have personal CA firewall. But combofix keep saying to uninstall CA personal firewall...

[lostcause]

I can snooze the CA anti virus, but that is not good enough for combofix...it wants it to uninstall or access is denied,.

[Elise]

Yes, just checked, CA will interfere with combofix's running, hence you need to uninstall it. If that really is a problem, please let me know what problems you are still having at this point.

[lostcause]

Sorry, I have been away for a little while...we cannot uninstall CA because it was installed by the company...afraid I cannot install it back in...as for the problems I have now. It seems to be working okay...not much problems. Just concern something is still lingering, but can't do what you recommend for now. Thank you for everything...I really appreciate it. This website is helping a lot of people out and it is just great!

[Elise]

Does the internet work now too?

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

Your version of Adobe Reader is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Adobe components and update:

• Download the latest version of Adobe Reader Version X. and save it to your desktop.
  
• Uncheck the "Free McAfee Security plan Plus" option or any other Toolbar you are offered
  
• Click the download button at the bottom.
  
• If you use Internet Explorer and do not wish to install the ActiveX element, simply click on the click here to download link on the next page.
  
• Remove all older version of Adobe Reader: Go to Add/remove and uninstall all versions of Adobe Reader, Acrobat Reader and Adobe Acrobat.
  If you are unsure of how to use Add or Remove Programs, the please see this tutorial:How To Remove An Installed Program From Your Computer
  
• Then from your desktop double-click on Adobe Reader to install the newest version.
  If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  
• When the "Adobe Setup - Welcome" window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  

Your Adobe Reader is now up to date!

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Download the latest version of Java Runtime Environment (JRE) Version 7u2.
  
• Look for "JDK 7u2 (JDK or JRE).
  
• Click the "Download JRE" button at the right.
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
  • Select "Windows x86 Offline" and click on jre-7-windows-i586.exe
    

  [*]Save it to your desktop

  [*]Close any programs you may have running - especially your web browser.

  [*]Uninstall all older versions of Java (any item with Java Runtime Environment, JRE or J2SE in the name).

  [*]Reboot your computer once all Java components are removed.

  [*]Install the newest version by double clicking (run as Administrator for Windows Vista/Seven) the downloaded file.

Please launch MBAM, update it and run a full scan. Post me the resulting log.

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!