just keeps coming back

[skyclimbers]

mbam_log_2009_02_11__05_21_31_.txthijackthis.txt

avira will not install in safe mode or normal . gives the pop up window that says crc has been changed this may be due

to a virus and the only option is to stop the install.

Thanks for any help!

Mike

mbam_log_2009_02_11__05_21_31_.txt

hijackthis.txt

[AdvancedSetup]

The log for MBAM shows you did not take any action to remove it. Please run and update MBAM again and this time select to FIX the issues found.

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then RESTART the computer

AFTER the reboot run HJT Do a system scan and save a logfile

The post back NEW MBAM and HJT logs in that order please.

[skyclimbers]

I've uploaded the new mbam log.. I'm not sure why, but this time the forum is telling me I am not permitted to upload the hijack this log???? It let me the first time.

I don't know if it matters or not, but after I hit "remove selected", it removed everything then a window came up that said Windows cannot find C:\windows\services.exe

mbam_log_2009_02_14__19_11_07_.txt

mbam_log_2009_02_14__19_11_07_.txt

Edited February 15, 2009 by AdvancedSetup
Removed un-needed quoting

[AdvancedSetup]

Please run the following tool. When replying please click on the ADDREPLY button and not on the REPLY button. Thanks.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Click
  Yes
  to allow ComboFix to continue scanning for malware.
  
  
• When the tool is finished, it will produce a report for you.
  
  
• Please post the
  C:\ComboFix.txt
  along with a
  new HijackThis log
  so we may continue cleaning the system.
  
  

[skyclimbers]

combo fix log attached

still says I'm not permitted to upload the hijackthis log.

Thanks

log.txt

log.txt

[AdvancedSetup]

These files are infected.

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

Please see if Dr Web can repair them or not. If not then you will need either the Windows XP CD or a method to copy over good files from another PC or slave the drive to a working PC and copy them over.

Download to the desktop: Dr.Web CureIt

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
  
• Back at the main window, mark the drives that you want to scan.
  
• Select all drives. A red dot shows which drives have been chosen.
  
• Click the green arrow at the right, and the scan will start.
  
• Click 'Yes to all' if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can click next icon next to the files found:
  
  If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  
• Save the report to your desktop. The report will be called DrWeb.csv
  
• Close Dr.Web Cureit.
  
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log.
  

You can also try this Anti-Virus program.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

• Download the
  Avira AntiVir Rescue System
  from
  here
• Place a blank CD in your burner and double-click on the downloaded file.
  
  
• The program will automatically burn the CD for you.
  
  
• Place the burned CD into the affected computer and start the computer from this CD.
  
  
• On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
  
  
• Click on the
  Configuration
  button.
  
  
  • Select
    Scan all files
  • Select
    Try to repair infected files
    and
    Rename files, if they cannot be removed
    
    
  • Select
    Scan for dialers
    
    
  • Select
    Scan for joke programs (Jokes)
    
    
  • Select
    Scan for games
    
    
  • Select
    Scan for spyware (SPR)
    
    
  [*]
  Click on
  Virus scanner
  [*]
  Click on
  Start scanner
  at the bottom of the screen
  [*]
  Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Screen resolution problems

Please see the post

here

if you're unable to view the entire screen of Avira.

[skyclimbers]

Still can't post a hijackthis log. After I ran Dr Web cure it-- I rebooted and ran mbam and it did not find anything.

I then shut down the pc and on the shut down screen when windows says saving your settings, windows is shutting down etc.,

It also said installing update 1 of 1. After it finished shutting down, I rebooted again and ran mbam one more time and it still did not find anything.

I did not run the avira rescue program yet.

dr_web.txt

mbam_log_2009_02_16__05_51_50_.txt

dr_web.txt

mbam_log_2009_02_16__05_51_50_.txt

[AdvancedSetup]

Your system is infected with the Win32.Virut virus. The best thing to do is backup your data, mail, pictures, etc. and FDISK, FORMAT, and re-install Windows.

This virus has affected every executable file on your system. Dr Web and other AV applications attempt to fix it but most of us feel it's a lost cause. You can spend days on trying to fix the damage and still not know if it's really ever been fixed and you'll never be able trust this box for stuff like Banking or other personal data transactions.

Make sure any other systems you have are scanned and running up to date protection and Windows Updates from Microsoft. This virus can infect other computers on a network if not protected.