Please Help MB cannot remove

Jticks · November 22, 2009

Thank you in advance for any help- I am stuck and

in desperate need of any advice.

I am Running a Dell Inspiron 9300 laptop with XP.

I tried to restore to earlier date and virus locked me out

with administator message. I tried safe mode and would not

let me. I am not a techie but would appreciate any other

suggestion to kill the virus located by Mbam.. below is my

log. thanks JP

Malwarebytes' Anti-Malware 1.41

Database version: 2775

Windows 5.1.2600 Service Pack 2

11/22/2009 8:49:34 AM

mbam-log-2009-11-22 (08-49-26).txt

Scan type: Quick Scan

Objects scanned: 127174

Time elapsed: 4 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\Temp\csrss.exe (Trojan.Agent) -> No action taken.

C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> No action taken.

C:\Documents and Settings\Jonathan\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> No action taken.

C:\WINDOWS\Temp\taskmgr.exe (Trojan.Downloader) -> No action taken.

SpySentinel · November 22, 2009

Hi Jticks, welcome to Malwarebytes

Please run Malwarebytes again and this time when it finds the threats please choose to remove them.

then......

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Jticks · November 22, 2009

Hi Jticks, welcome to Malwarebytes
Please run Malwarebytes again and this time when it finds the threats please choose to remove them.
then......
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

thanks for the reply and help... I cannot REMOVE the items. Once clicked it freezes..

SpySentinel · November 22, 2009

You're welcome.

Thank you for letting me know.

Go ahead to the ComboFix step and let me know if it runs ok. If it does post the log here in a reply.

Jticks · November 22, 2009

You're welcome.
Thank you for letting me know.
Go ahead to the ComboFix step and let me know if it runs ok. If it does post the log here in a reply.

Thank you again for your help... Below is the log file after running combofix 2 times. After the first time I could not

locate the log file and it appeared to hang up after 30 min of preparing the log file. The text below is from the 2nd

run. Again thanks for your kind assistance. JP

-----------------------------------------

ComboFix 09-11-21.03 - Jonathan 11/22/2009 13:07.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.609 [GMT -6:00]

Running from: E:\ComboFix.exe

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

c:\documents and settings\HelpAssistant.JONATHANWG1.001\ntuser.dll

c:\documents and settings\Jonathan\ntuser.dll

c:\documents and settings\Jonathan\Start Menu\Programs\Startup\scandisk.dll

c:\documents and settings\Jonathan\Start Menu\Programs\Startup\scandisk.lnk

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\CPV.stt

c:\documents and settings\NetworkService\ntuser.dll

c:\temp\1cb\syscheck.log

c:\temp\DIV55\xDb.log

c:\windows\kb913800.exe

c:\windows\system32\C\MTK63G.exe

c:\windows\system32\calc.dll

c:\windows\system32\config\systemprofile\ntuser.dll

c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\scandisk.dll

c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\scandisk.lnk

c:\windows\system32\Ijl11.dll

c:\windows\system32\ki3\RI2ES6i.exe

c:\windows\system32\kozeyizu.dll.tmp

c:\windows\system32\sawuzowu(2).dll

c:\windows\system32\tinuhagu.dll.tmp

c:\windows\system32\vogekomu.dll.tmp

c:\windows\system32\worayewu.dll.tmp

c:\windows\system32\wotunivo.dll.tmp

c:\windows\system32\yapafeju.dll.tmp

c:\windows\Temp\2958525059.exe

c:\windows\Temp\3909931309.exe

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected

Restored copy from - Kitty ate it

.

((((((((((((((((((((((((( Files Created from 2009-10-22 to 2009-11-22 )))))))))))))))))))))))))))))))

.

2009-11-22 19:07 . 2004-08-10 11:00 95360 -c--a-w- c:\windows\system32\dllcache\atapi.sys

2009-11-22 19:07 . 2004-08-10 11:00 95360 ----a-w- c:\windows\system32\drivers\atapi.sys

2009-11-22 14:26 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-22 14:26 . 2009-11-22 14:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-22 14:26 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-22 12:33 . 2009-11-22 12:33 -------- d-----w- c:\documents and settings\Jonathan\Application Data\IObit

2009-11-21 05:43 . 2009-11-21 05:43 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.001\Temp

2009-11-21 05:38 . 2009-10-26 12:26 72080 ----a-w- c:\documents and settings\HelpAssistant.JONATHANWG1.001\g2mdlhlpx.exe

2009-11-21 05:38 . 2009-11-21 05:38 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.001\Dr Delete

2009-11-21 05:38 . 2009-11-21 05:38 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.001\DoctorWeb

2009-11-21 05:34 . 2009-11-22 12:28 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.001\.housecall6.6

2009-11-21 05:34 . 2009-11-22 18:57 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.001

2009-11-21 05:31 . 2009-11-21 05:31 -------- d-----w- c:\windows\system32\wbem\Repository

2009-11-20 20:26 . 2009-11-22 12:32 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.000\UserData

2009-11-20 20:26 . 2009-11-20 20:26 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.000\Temp

2009-11-20 20:22 . 2009-11-20 20:22 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.000\Dr Delete

2009-11-20 20:22 . 2009-11-20 20:22 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.000\DoctorWeb

2009-11-20 20:19 . 2009-11-22 12:29 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1.000\.housecall6.6

2009-11-20 20:19 . 2009-11-22 12:32 -------- d-s---w- c:\documents and settings\HelpAssistant.JONATHANWG1.000

2009-11-20 19:15 . 2009-11-22 12:32 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1\UserData

2009-11-20 19:15 . 2009-11-20 19:15 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1\Temp

2009-11-20 19:07 . 2009-11-20 19:07 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1\Dr Delete

2009-11-20 19:07 . 2009-11-20 19:07 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1\DoctorWeb

2009-11-20 19:03 . 2009-11-22 12:31 -------- d-----w- c:\documents and settings\HelpAssistant.JONATHANWG1\.housecall6.6

2009-11-20 19:03 . 2009-11-22 12:32 -------- d-s---w- c:\documents and settings\HelpAssistant.JONATHANWG1

2009-11-20 19:00 . 2009-11-22 12:31 -------- d-----w- c:\documents and settings\HelpAssistant\My Documents(2)

2009-11-20 18:56 . 2009-11-20 18:56 -------- d-----w- c:\documents and settings\HelpAssistant\Dr Delete

2009-11-20 18:56 . 2009-11-20 18:56 -------- d-----w- c:\documents and settings\HelpAssistant\DoctorWeb

2009-11-20 18:51 . 2009-11-22 12:31 -------- d-----w- c:\documents and settings\HelpAssistant\.housecall6.6

2009-11-20 18:51 . 2009-11-22 12:32 -------- d-s---w- c:\documents and settings\HelpAssistant

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-22 12:39 . 2009-11-22 11:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-11-22 12:30 . 2009-09-17 11:18 -------- d-----w- c:\program files\ffdshow

2009-11-22 12:27 . 2007-01-25 02:46 -------- d-----w- c:\program files\Microsoft ActiveSync

2009-11-22 12:07 . 2009-11-22 12:07 -------- d-----w- c:\program files\IObit

2009-11-21 05:53 . 2008-10-20 18:16 -------- d-----w- c:\program files\Common Files\Apple

2009-11-21 05:38 . 2009-11-20 20:23 4904 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2009-10-30 20:26 . 2007-09-09 04:16 38400 ----a-w- c:\windows\system32\hpz3l054.dll

2009-10-26 12:26 . 2007-05-06 11:03 72080 ----a-w- c:\documents and settings\Jonathan\g2mdlhlpx.exe

2009-10-08 12:52 . 2008-07-08 21:48 -------- d-----w- c:\documents and settings\Jonathan\Application Data\Skype

2009-10-08 12:47 . 2008-07-08 21:49 -------- d-----w- c:\documents and settings\Jonathan\Application Data\skypePM

2009-10-06 02:39 . 2009-10-06 02:39 -------- d-----w- c:\program files\CCleaner

2009-09-02 20:38 . 2009-09-02 20:37 1924440 ----a-w- c:\documents and settings\Jonathan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2009-08-31 13:41 . 2009-08-31 13:41 152576 ----a-w- c:\documents and settings\Jonathan\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

2005-08-02 22:58 . 2008-12-08 23:52 293888 --sha-r- c:\windows\Sm9uYXRoYW4gUGFnZQ\command.exe

2005-07-29 22:24 . 2008-12-08 23:52 472 --sha-r- c:\windows\Sm9uYXRoYW4gUGFnZQ\mA6RsrlCsqb0o3IBtk.vbs

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{6EDCCE69-14A2-4E9F-826B-DC523B82167E}"= "c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll" [2007-02-02 591360]

[HKEY_CLASSES_ROOT\clsid\{6edcce69-14a2-4e9f-826b-dc523b82167e}]

[HKEY_CLASSES_ROOT\IexploreOmea.Band.1]

[HKEY_CLASSES_ROOT\TypeLib\{633820F7-C04E-4152-B64F-1147B881F998}]

[HKEY_CLASSES_ROOT\IexploreOmea.Band]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-07-23 401408]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-07-23 385024]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940]

"forsinit"="c:\windows\sprscore.exe" [2007-04-22 724992]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-23 185872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2005-07-23 06:46 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\eSignal\\winros.exe"=

"c:\\Program Files\\OEC\\Trader\\Trader.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:Remote Desktop

S1 drmkaudd;drmkaudd;c:\windows\system32\drivers\drmkaudd.sys --> c:\windows\system32\drivers\drmkaudd.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [11/22/2009 8:26 AM 38224]

S3 PTDWBus;Curitel PC Card Composite Device driver (UDP);c:\windows\system32\drivers\PTDWBus.sys [6/23/2007 8:21 AM 27392]

S3 PTDWMdm;Curitel PC Card Drivers (UDP);c:\windows\system32\drivers\PTDWMdm.sys [6/23/2007 8:21 AM 41728]

S3 PTDWVsp;Curitel PC Card Diagnostic Serial Port (UDP);c:\windows\system32\drivers\PTDWVsp.sys [6/23/2007 8:21 AM 39808]

S3 PWCTLDRV;The NECHostController Filter Driver;c:\windows\system32\drivers\PWCTLDRV.sys [6/23/2007 8:21 AM 5888]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2

*Deregistered* - CLASSPNP_2

.

Contents of the 'Scheduled Tasks' folder

2009-11-22 c:\windows\Tasks\User_Feed_Synchronization-{B697CC3E-95F1-4D18-9EF7-E05701EF1D2D}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 19:58]

.

------- Supplementary Scan -------

.

uStart Page = www.rbc.org/odb/odb.shtml

mWindow Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet

uInternet Connection Wizard,ShellNext = hxxp://espn.go.com/motion/detect.html

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Clip and Edit - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000

IE: Clip and Save - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Subscribe to Feed - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002

TCP: {570E0C3D-F910-4546-B892-A911C90EDDEA} = 83.149.115.182

DPF: {43F25BA2-C4AB-4327-924C-1ED6AF4A6BA1} - hxxp://www.webacall.com/activePhone.ocx

FF - ProfilePath - c:\documents and settings\Jonathan\Application Data\Mozilla\Firefox\Profiles\8jesdy4y.default\

FF - prefs.js: browser.search.selectedEngine - fefoo search

FF - prefs.js: browser.startup.homepage - hxxp://www.rbc.org/odb/odb.shtml

FF - plugin: c:\progra~1\MEADCO~1\npmeadax.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\QuickTime\Plugins\npatgpc.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{dd5f4041-9792-4931-887a-8e50946ef28b} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-22 13:13

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x868FDF30]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf76cafc3

\Driver\ACPI -> ACPI.sys @ 0xf753dcb8

\Driver\atapi -> 0x868fdf30

IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578c34

ParseProcedure -> ntkrnlpa.exe @ 0x80577896

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80578c34

ParseProcedure -> ntkrnlpa.exe @ 0x80577896

NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x8693a480

PacketIndicateHandler -> NDIS.sys @ 0xf739bb21

SendHandler -> NDIS.sys @ 0xf737987b

Warning: possible MBR rootkit infection !

copy of MBR has been found in sector 0x0DF8F900

malicious code @ sector 0x0DF8F903 !

PE file found in sector at 0x0DF8F919 !

MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)

c:\windows\system32\Ati2evxx.dll

c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'explorer.exe'(2632)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2009-11-22 13:15

ComboFix-quarantined-files.txt 2009-11-22 19:15

Pre-Run: 85,255,626,752 bytes free

Post-Run: 85,215,498,240 bytes free

- - End Of File - - F0347C78AE9BA426F528EEF7D5E254A9

SpySentinel · November 22, 2009

Download GMER's MBR.exe to your desktop.

Double click on the MBR.exe file to run it. A log will be produced, MBR.log. Please open this log in Notepad and post its contents in your next reply.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Folder::
c:\windows\Sm9uYXRoYW4gUGFnZQ
c:\documents and settings\Jonathan\Application Data\IObit

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Jticks · November 22, 2009

Download GMER's MBR.exe to your desktop.
Double click on the MBR.exe file to run it. A log will be produced, MBR.log. Please open this log in Notepad and post its contents in your next reply.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
[/quote
-----------------------------------------------------------
I am sorry-- I appreciate your patience. I am not very knowledgeable in understanding your instructions.
I ran the MBR link and got the following message delivered in notepad:
"Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x868fdf30
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x8693a480
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0DF8F900
malicious code @ sector 0x0DF8F903 !
PE file found in sector at 0x0DF8F919 !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix."
I then tried to follow the 2nd set of instructions but was uncertain what to do.
I found the folder named "c:\documents and settings\Jonathan\Application Data\IObit"
inside that folder was another folder named Advanced SystemCare and Backup inside that folder.
Am I supposed to paste the whole log from above into the folder named IObit?
I guess I don't understand "in the quotebox below into it"
thanks again for your patience and help.......

Jticks · November 22, 2009

Sorry for my ineptness-- thanks again for staying with/helping me. I followed the

directions per your last post and here are the to logs..

---------

ComboFix 09-11-22.02 - Jonathan 11/22/2009 16:29.6.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.550 [GMT -6:00]

Running from: c:\documents and settings\Jonathan\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Jonathan\Desktop\CFScript.txt

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Jonathan\Application Data\IObit

c:\documents and settings\Jonathan\Application Data\IObit\Advanced SystemCare\Fav.ico

c:\documents and settings\Jonathan\Application Data\IObit\Advanced SystemCare\Ignore.ini

c:\documents and settings\Jonathan\Application Data\IObit\Advanced SystemCare\Main.ini

c:\windows\Sm9uYXRoYW4gUGFnZQ

c:\windows\Sm9uYXRoYW4gUGFnZQ\command.exe

c:\windows\Sm9uYXRoYW4gUGFnZQ\mA6RsrlCsqb0o3IBtk.vbs

.

((((((((((((((((((((((((( Files Created from 2009-10-22 to 2009-11-22 )))))))))))))))))))))))))))))))

.

2009-11-22 22:29 . 2004-08-10 11:00 95360 -c--a-w- c:\windows\system32\dllcache\atapi.sys

2009-11-22 22:29 . 2004-08-10 11:00 95360 ----a-w- c:\windows\system32\drivers\atapi.sys