trojan.bho.h removal help

[seclemmons]

I have been infected with trojan.bho.h and MBAM detects it and says it removes it, but the trojan is still there after a reboot. I have followed the directions found in the sticky and will post results below and attach required files. Thank you in advance for any help you can provide. Let me know if I have missed anything and I will reconcile as soon as possible.

-Steve

Malwarebytes' Anti-Malware 1.44

Database version: 3826

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18882

3/5/2010 6:15:40 PM

mbam-log-2010-03-05 (18-15-24).txt

Scan type: Quick Scan

Objects scanned: 107754

Time elapsed: 5 minute(s), 40 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\shamis\AppData\Local\Temp\low\COUPON~1.DLL (Trojan.BHO.H) -> No action taken.

DDS (Ver_09-12-01.01) - NTFSx86

Run by shamis at 16:40:08.75 on Fri 03/05/2010

Internet Explorer: 8.0.6001.18882

Microsoft

ark.zip

[fenzodahl512]

Hello.. Lets do this first...

Please download CleanUp! by stevengould.org and save it to your Desktop.

• Double-click CleanUp452.exe and install CleanUp! to your computer
  
• Open CleanUp! and click on Options.. button.
  
• Under General tab, choose Standard CleanUp! and then click Ok
  
• Click on the CleanUp! button. When it asked you to logoff Windows, click on Yes
  
• Let your Windows rebooted (or do it manually) and then scan again with Malwarebytes'.. Is it still there?
  

[seclemmons]

Thank you for your reply. I ran cleanup as instructed and ran another scan. Unfortunately, the virus is still there. Here is the log file from MBAM after the scan.

Malwarebytes' Anti-Malware 1.44

Database version: 3831

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18882

3/7/2010 8:27:10 AM

mbam-log-2010-03-07 (08-27-10).txt

Scan type: Quick Scan

Objects scanned: 105266

Time elapsed: 4 minute(s), 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\shamis\AppData\Local\Temp\low\COUPON~1.DLL (Trojan.BHO.H) -> Quarantined and deleted successfully.

Thank you for any future help.

[fenzodahl512]

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from HERE or HERE and save it to your Desktop.

During the download, rename Combofix to Combo-Fix as follows:

It is important you rename Combofix during the download, but not after.

**NOTE: If you are using Firefox, make sure that your download settings are as follows:

• Tools->Options->Main tab
  
• Set to "Always ask me where to Save the files".
  

After that, double-click and run Combo-Fix. Let it finish its job and post the log here

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!