Infected with PUM.Hijack.StartMenu, help?

[Copperbird]

9 "threats" were found, but they're all just programs that were built-in (Windows services and Roxio). I'm running Combofix now.

[Copperbird]

It says pev.exe has stopped working.

[Copperbird]

I'm sorry, I mean pev.3xe.

[MrCharlie]

Download and run rkill first and then run ComboFix, if the error pops-up...close it out and continue.

http://www.bleepingcomputer.com/download/rkill/

MrC

[Copperbird]

I don't know if you need it, but here's the Rkill report:

Rkill 2.5.3 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

Copyright 2008-2013 BleepingComputer.com

More Information about Rkill can be found at this link:

 http://www.bleepingcomputer.com/forums/topic308364.html

 

Program started at: 07/05/2013 08:47:37 AM in x86 mode.

Windows Version: Windows Vista Home Premium Service Pack 2

 

Checking for Windows services to stop:

 

 * No malware services found to stop.

 

Checking for processes to terminate:

 

 * No malware processes found to kill.

 

Checking Registry for malware related settings:

 

 * No issues found in the Registry.

 

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

 

Performing miscellaneous checks:

 

 * Windows Defender Disabled

 

   [HKLM\SOFTWARE\Microsoft\Windows Defender]

   "DisableAntiSpyware" = dword:00000001

 

 * Windows Firewall Disabled

 

   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

   "EnableFirewall" = dword:00000000

 

Checking Windows Service Integrity: 

 

 * Windows Defender (WinDefend) is not Running.

   Startup Type set to: Manual

 

Searching for Missing Digital Signatures: 

 

 * No issues found.

 

Checking HOSTS File: 

 

 * Cannot edit the HOSTS file.

 * Permissions Fixed. Administrators can now edit the HOSTS file.

 

 * HOSTS file entries found: 

 

  127.0.0.1       localhost

  173.192.170.88 drghwaweg45j4i6u3q32fg2h.com

 

Program finished at: 07/05/2013 08:50:13 AM

Execution time: 0 hours(s), 2 minute(s), and 35 seconds(s)

[Copperbird]

Combofix rebooted itself and is now constantly glitching. Please help, it is opening and closing itself constantly.

[Copperbird]

My computer is unusable. I am talking to you through my ipad.

[MrCharlie]

Shut it off completely and restart, see what happens. MrC

[Copperbird]

The glitch is still there.

[Copperbird]

I was able to close the glitch temporarily (every time I log on it appears) by quickly closing one of the moving Combofix windows.

[Copperbird]

Also, the Combofix log is gone.

[MrCharlie]

Can you stop ComboFix?

MrC

[Copperbird]

Yes, I stopped the application, so it is no longer running nor is it on Task Manager.

[Copperbird]

But stopping it only lasts for one session. When I restart it and log back on, it returns. Can I uninstall it?

[MrCharlie]

Just let it run then, see if it completes....MrC

[Copperbird]

I ran it again, and the same thing happened: it automatically rebooted, and when I logged in, the Combofix window was popping up and closing.

[MrCharlie]

OK, stop ComboFix.

ComboFix creates a system restore point just before it runs, see if you can use it.

 

MrC

[Copperbird]

Where can I find the system restore point, please?

[MrCharlie]

http://www.bleepingcomputer.com/tutorials/windows-vista-system-restore-guide/#restore

 

You can do this in safe mode if needed.

 

MrC

[Copperbird]

I do not see the Hiv-backup file that is described in the Bleeping Computer article.

[Copperbird]

The BleepingComputer article that I was referring to, the one about the Hiv file, was the Combofix article. So far the System Restore is working fine. Thanks again.

[Copperbird]

The system is restored now.

[MrCharlie]

Good, and it's running OK now?

Did you use the restore point from ComboFix?

 

MrC

 

[Copperbird]

There was no restore point from Combofix (Bleeping Comouter said there was a Hiv-Backup file in the Combofix file, but that was not there either) found--- The most recent restore point was from yesterday, at midnight. It is running ok now though.

[Copperbird]

Sorry, the restore point was actually at 12 PM yesterday, so Roguekiller and the TDSSKiller are not there. Do I have to rerun them?