Hijack.regedit and Hijack.folderoptions

[konsymp]

I also recently had some problems with Malware. I was able to remove them with the exception of two infections called Hijack.regedit and Hijack.folderoptions. Any help will be appreciated.

I've downloaded Combo Fix after reading the other thread in this forum with the same problem, although i have yet to install or run it until i posted the log file here.

Here are the logs:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:17:16 AM, on 3/6/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

D:\adaware\aawservice.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

D:\acrobat\Distillr\Acrotray.exe

D:\log\x86\LogMeInSystray.exe

C:\WINDOWS\system32\spoolsv.exe

D:\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\wmisrv32.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

D:\log\x86\LMIGuardian.exe

D:\acrobat\Acrobat\acrobat_sl.exe

C:\Program Files\Bonjour\mDNSResponder.exe

D:\diskkeeper\DkService.exe

D:\log\x86\RaMaint.exe

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\seh1gt9u0zo5.exe

D:\log\x86\LogMeIn.exe

D:\log\x86\LMIGuardian.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\acrobat\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\acrobat\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

O4 - HKLM\..\Run: [DiskeeperSystray] "D:\diskkeeper\DkIcon.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\acrobat\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe

O4 - HKLM\..\Run: [LogMeIn GUI] "D:\log\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Microsoft Windows Service] explorer.exe

O4 - HKLM\..\Run: [winfw] wmisrv32.exe

O4 - HKLM\..\RunServices: [winfw] wmisrv32.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Microsoft Windows Service] explorer.exe

O4 - HKCU\..\Run: [winfw] wmisrv32.exe

O4 - HKCU\..\Run: [cd2zjwkokv9i0gfi0k3oeagx0] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ikzg1rc.exe

O4 - HKCU\..\Run: [n2017ujgnplhb6ti] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t289tn6eds77.exe

O4 - HKCU\..\Run: [ime611s1zer7g05pqv24s92en3ueagbddk8i8k19ce] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\imvwx3ycoqn.exe

O4 - HKCU\..\Run: [vluxw2a4rxc86ykl61u50xa53tfybxp72sh6p5ndlkt1] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\f6xmxa.exe

O4 - HKCU\..\Run: [t98920z9e8apa3elkctdo5bc56jppic8gnav1384p0q9z8k5th] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fj2bfj8.exe

O4 - HKCU\..\Run: [zqny44goxu] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\u01pqrfxk0.exe

O4 - HKCU\..\Run: [j93dpmjmog64iwq9fpta4n0pemtnm3k06o6xvf1hbdtr] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\niv7qxcg.exe

O4 - HKCU\..\Run: [ablbtk4jgu0jvl4r6bgr] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vvsj2bud.exe

O4 - HKCU\..\Run: [yml8imqqiz4dgqr4vaddwyq0cliui0i42k7ou722i8vgikv72] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zqhbxgz254.exe

O4 - HKCU\..\Run: [adcc6fkwagpy4gvey40bikd93sqla82xff3c6ixtb4p] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\smxnf4js1va.exe

O4 - HKCU\..\Run: [l0afgep5suxag27] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zv0v6x4g5.exe

O4 - HKCU\..\Run: [p2atpn1mlldp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vsdeagyywkgn.exe

O4 - HKCU\..\Run: [k0zygm4xru80mx8rytxua9t76bbw8owa1t5u5lh9hqtzp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\seh1gt9u0zo5.exe

O4 - HKCU\..\Run: [fq4b9v2gk] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ozpkjuy0rg37.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MOffice\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MOffice\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\adaware\aawservice.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Diskeeper Corporation - D:\diskkeeper\DkService.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - D:\log\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - D:\log\x86\LogMeIn.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 8274 bytes

[konsymp]

Malwarebytes' Anti-Malware 1.34

Database version: 1817

Windows 5.1.2600 Service Pack 2

3/6/2009 11:38:13 AM

mbam-log-2009-03-06 (11-38-10).txt

Scan type: Quick Scan

Objects scanned: 65542

Time elapsed: 1 minute(s), 38 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[AdvancedSetup]

Some of these entries may not be there anymore so just check and remove those that are found.

STEP 01

With all other applications closed (Taskbar empty), open HijackThis again

and run Do a system scan only and place a check mark on the following items.

• R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  
• O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\acrobat\Acrobat\AcroIEFavClient.dll
  
• O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\acrobat\Acrobat\AcroIEFavClient.dll
  
• O4 - HKLM\..\Run: [winfw] wmisrv32.exe
  
• O4 - HKLM\..\RunServices: [winfw] wmisrv32.exe
  
• O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  
• O4 - HKCU\..\Run: [Microsoft Windows Service] explorer.exe
  
• O4 - HKCU\..\Run: [winfw] wmisrv32.exe
  
• O4 - HKCU\..\Run: [cd2zjwkokv9i0gfi0k3oeagx0] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ikzg1rc.exe
  
• O4 - HKCU\..\Run: [n2017ujgnplhb6ti] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t289tn6eds77.exe
  
• O4 - HKCU\..\Run: [ime611s1zer7g05pqv24s92en3ueagbddk8i8k19ce] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\imvwx3ycoqn.exe
  
• O4 - HKCU\..\Run: [vluxw2a4rxc86ykl61u50xa53tfybxp72sh6p5ndlkt1] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\f6xmxa.exe
  
• O4 - HKCU\..\Run: [t98920z9e8apa3elkctdo5bc56jppic8gnav1384p0q9z8k5th] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fj2bfj8.exe
  
• O4 - HKCU\..\Run: [zqny44goxu] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\u01pqrfxk0.exe
  
• O4 - HKCU\..\Run: [j93dpmjmog64iwq9fpta4n0pemtnm3k06o6xvf1hbdtr] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\niv7qxcg.exe
  
• O4 - HKCU\..\Run: [ablbtk4jgu0jvl4r6bgr] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vvsj2bud.exe
  
• O4 - HKCU\..\Run: [yml8imqqiz4dgqr4vaddwyq0cliui0i42k7ou722i8vgikv72] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zqhbxgz254.exe
  
• O4 - HKCU\..\Run: [adcc6fkwagpy4gvey40bikd93sqla82xff3c6ixtb4p] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\smxnf4js1va.exe
  
• O4 - HKCU\..\Run: [l0afgep5suxag27] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zv0v6x4g5.exe
  
• O4 - HKCU\..\Run: [p2atpn1mlldp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vsdeagyywkgn.exe
  
• O4 - HKCU\..\Run: [k0zygm4xru80mx8rytxua9t76bbw8owa1t5u5lh9hqtzp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\seh1gt9u0zo5.exe
  
• O4 - HKCU\..\Run: [fq4b9v2gk] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ozpkjuy0rg37.exe
  
• O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
  
• O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
  
• O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
  
• O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
  
• O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
  
• O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
  Then Quit All Browsers including the one you're reading this in now.
  Then click on Fix checked and then quit HJT
  

STEP 02

Please UPDATE MBAM

YOUR VERSION

Malwarebytes' Anti-Malware 1.34

Database version: 1817

CURRENT VERSION

Malwarebytes' Anti-Malware 1.34

Database version: 1825

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then post back the MBAM log and a new Hijackthis log.

[konsymp]

Thank you for walking me through this.

Here are the logs.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:21:21 PM, on 3/10/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

D:\adaware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

D:\acrobat\Distillr\Acrotray.exe

D:\log\x86\LogMeInSystray.exe

D:\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

D:\log\x86\LMIGuardian.exe

C:\Program Files\Bonjour\mDNSResponder.exe

D:\diskkeeper\DkService.exe

D:\log\x86\RaMaint.exe

D:\log\x86\LogMeIn.exe

D:\log\x86\LMIGuardian.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

O4 - HKLM\..\Run: [DiskeeperSystray] "D:\diskkeeper\DkIcon.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\acrobat\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe

O4 - HKLM\..\Run: [LogMeIn GUI] "D:\log\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Microsoft Windows Service] explorer.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [dvqp0gq56xochhqfneo] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bowj1x3w3cb5r.exe

O4 - HKCU\..\Run: [qy2q0nu7y] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cchu0frysfn.exe

O4 - HKCU\..\Run: [a3wczfhjwq7zwx1v46wd1gqy369yyxj5ugaq8qhjmkun3leh] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dblijl0k8.exe

O4 - HKCU\..\Run: [agbhuhssux] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a1sehnr8.exe

O4 - HKCU\..\Run: [p900v66dhew4o1gwpfagrocvtqjvl67oz] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fb4mx77s3mqy.exe

O4 - HKCU\..\Run: [j3vz6exgui0yzqq0d53cazh6nk9f0vnb7] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\snlerc1ic2jx.exe

O4 - HKCU\..\Run: [mkcbt0if0hsmksunfh17f3cerrkwsid0bq2d] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t0bvjmhh.exe

O4 - HKCU\..\Run: [uc83juln8p5103m53lfnte3bfek7s] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\hmqis927.exe

O4 - HKCU\..\Run: [hjlcztaxb2] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ezrqyzaa8z.exe

O4 - HKCU\..\Run: [om9jge1hsmt0b5vjj2hi1hq3d687x] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\z30dqkyben.exe

O4 - HKCU\..\Run: [xva3ejdxxyyqa2pzb7y6vq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sm346llrf.exe

O4 - HKCU\..\Run: [b3eulc9k4404itjfhwmr29pi8zz2j344zyu0tzy6] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t5vfp4xqsx.exe

O4 - HKCU\..\Run: [yh1rtsb5hfjrewz239tnsp5xp01ky] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ti55axnn.exe

O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MOffice\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MOffice\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\adaware\aawservice.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Diskeeper Corporation - D:\diskkeeper\DkService.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - D:\log\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - D:\log\x86\LogMeIn.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 6865 bytes

[konsymp]

Malwarebytes' Anti-Malware 1.34

Database version: 1832

Windows 5.1.2600 Service Pack 2

3/10/2009 5:15:35 PM

mbam-log-2009-03-10 (17-15-35).txt

Scan type: Quick Scan

Objects scanned: 66132

Time elapsed: 1 minute(s), 38 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

C:\Documents and Settings\Administrator\Local Settings\Temp\u7iq6u.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WS2IFSL (Fake.Driver) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eca3rywuedzp5euygcwwv6hl51kezlkq (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Administrator\Local Settings\Temp\u7iq6u.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\ccxg.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

C:\gfwy.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\yhfes.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

[AdvancedSetup]

Please run the following

STEP 01

Download and install CCleaner
• CCleaner
  
• Double-click on the downloaded file "ccsetup217.exe" and install the application.
  
• Keep the default installation folder "C:\Program Files\CCleaner"
  
• Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
  
• Click finish when done and close ALL PROGRAMS
  
• Start the CCleaner program.
  
• Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  
• Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  
• Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  
• Click on Run Cleaner button on the bottom right side of the program.
  
• Click OK to any prompts
  

STEP 02

Please download to your Desktop: Dr.Web CureIt

• After the file has downloaded, disable your current Anti-Virus and disconnect from the Internet
  
• Doubleclick the drweb-cureit.exe file, then click the Start button, then the OK button to perform an Express Scan.
  
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click on the Complete scan radio button.
  
• Then click on the Settings menu on top, the select Change Settings or press the F9 key. You can also change the Language
  
• Choose the Scanning tab and I recomend leaving the Heuristic analysis enabled (this can lead to False Positives though)
  
• On the File types tab ensure you select All files
  
• Click on the Actions tab and set the following:
  
  • Objects Infected objects = Cure, Incurable objects = Move, Suspicious objects = Report
    
  • Infected packages Archive = Move, E-mails = Report, Containers = Move
    
  • Malware Adware = Move, Dialers = Move, Jokes = Move, Riskware = Move, Hacktools = Move
    
  • Do not change the Rename extension - default is: #??
    
  • Leave the default save path for Moved files here: %USERPROFILE%\DoctorWeb\Quarantine\
    
  • Leave prompt on Action checked
    

  [*]On the Log file tab leave the Log to file checked.

  [*]Leave the log file path alone: %USERPROFILE%\DoctorWeb\CureIt.log

  [*]Log mode = Append

  [*]Encoding = ANSI

  [*]Details Leave Names of file packers and Statistics checked.

  [*]Limit log file size = 2048 KB and leave the check mark on the Maximum log file size.

  [*]On the General tab leave the Scan Priority on High

  [*]Click the Apply button at the bottom, and then the OK button.

  [*]On the right side under the Dr Web Anti-Virus Logo you will see 3 little buttons. Click the left VCR style Start button.

  [*]In this mode it will scan Boot sectors of all disks, All removable media, and all local drives

  [*]The more files and folders you have the longer the scan will take. On large drives it can take hours to complete.

  [*]When the Cure option is selected, an additional context menu will open. Select the necessary action of the program, if the curing fails.

  [*]Click 'Yes to all' if it asks if you want to cure/move the files.

  [*]This will move it to the %USERPROFILE%\DoctorWeb\Quarantine\ folder if it can't be cured. (in this case we need samples)

  [*]After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list

  [*]Save the report to your Desktop. The report will be called DrWeb.csv

  [*]Close Dr.Web Cureit.

  [*]Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.

  [*]After reboot, post the contents of the log from Dr.Web you saved previously to your Desktop in your next reply with a new hijackthis log.

  

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

[AdvancedSetup]

Post re-opened at user's request.

[konsymp]

The Dr.Web Cure it .exe. crashes.

i get the error message "setup.exe has encountered a problem and needs to close" clicked dont send then the message "DrWatson Postmortem Debugger has encountered a problem and needs to close." clicked don't send.

here is a log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:33:33 AM, on 3/19/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

D:\adaware\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

D:\acrobat\Distillr\Acrotray.exe

D:\log\x86\LogMeInSystray.exe

C:\Program Files\Bonjour\mDNSResponder.exe

D:\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

D:\diskkeeper\DkService.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

D:\log\x86\LMIGuardian.exe

D:\log\x86\RaMaint.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

D:\log\x86\LogMeIn.exe

D:\log\x86\LMIGuardian.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\System32\svchost.exe

D:\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

O4 - HKLM\..\Run: [DiskeeperSystray] "D:\diskkeeper\DkIcon.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\acrobat\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe

O4 - HKLM\..\Run: [LogMeIn GUI] "D:\log\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Microsoft Windows Service] explorer.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [dvqp0gq56xochhqfneo] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bowj1x3w3cb5r.exe

O4 - HKCU\..\Run: [qy2q0nu7y] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cchu0frysfn.exe

O4 - HKCU\..\Run: [a3wczfhjwq7zwx1v46wd1gqy369yyxj5ugaq8qhjmkun3leh] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dblijl0k8.exe

O4 - HKCU\..\Run: [agbhuhssux] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a1sehnr8.exe

O4 - HKCU\..\Run: [p900v66dhew4o1gwpfagrocvtqjvl67oz] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fb4mx77s3mqy.exe

O4 - HKCU\..\Run: [j3vz6exgui0yzqq0d53cazh6nk9f0vnb7] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\snlerc1ic2jx.exe

O4 - HKCU\..\Run: [mkcbt0if0hsmksunfh17f3cerrkwsid0bq2d] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t0bvjmhh.exe

O4 - HKCU\..\Run: [uc83juln8p5103m53lfnte3bfek7s] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\hmqis927.exe

O4 - HKCU\..\Run: [hjlcztaxb2] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ezrqyzaa8z.exe

O4 - HKCU\..\Run: [om9jge1hsmt0b5vjj2hi1hq3d687x] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\z30dqkyben.exe

O4 - HKCU\..\Run: [xva3ejdxxyyqa2pzb7y6vq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sm346llrf.exe

O4 - HKCU\..\Run: [b3eulc9k4404itjfhwmr29pi8zz2j344zyu0tzy6] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t5vfp4xqsx.exe

O4 - HKCU\..\Run: [yh1rtsb5hfjrewz239tnsp5xp01ky] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ti55axnn.exe

O4 - HKUS\S-1-5-21-854245398-2052111302-725345543-1004\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LogMeInRemoteUser')

O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://D:\acrobat\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MOffice\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MOffice\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\adaware\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Diskeeper Corporation - D:\diskkeeper\DkService.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - D:\log\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - D:\log\x86\LogMeIn.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 7752 bytes

[konsymp]

updated dr. web cure it. still crashes

[konsymp]

bump.

[AdvancedSetup]

Okay then please try to download and burn this from another computer.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

• Download the
  Avira AntiVir Rescue System
  from
  here
• Place a blank CD in your burner and double-click on the downloaded file.
  
  
• The program will automatically burn the CD for you.
  
  
• Place the burned CD into the affected computer and start the computer from this CD.
  
  
• On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
  
  
• Click on the
  Configuration
  button.
  
  
  • Select
    Scan all files
  • Select
    Try to repair infected files
    and
    Rename files, if they cannot be removed
    
    
  • Select
    Scan for dialers
    
    
  • Select
    Scan for joke programs (Jokes)
    
    
  • Select
    Scan for games
    
    
  • Select
    Scan for spyware (SPR)
    
    
  [*]
  Click on
  Virus scanner
  [*]
  Click on
  Start scanner
  at the bottom of the screen
  [*]
  Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Screen resolution problems

Please see the post

here

if you're unable to view the entire screen of Avira.

[AdvancedSetup]

Please post a status update on this.

[AdvancedSetup]

checking back. We will close your post very soon if we don't hear back from you.

Thanks.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.