Friends infected computer. AVGT spamweblist block

[scarecrowman]

This computer is quite heavily infected. I've dealt with a few infected computers in the past, but this one is beyond me. I'm hoping one of the experts will be able to help me out. You guys are the best!

I have run a scan or two with MBAM, Spybot and AVG Free. I hope this won't interfere, and I will not do anything more until instructed.

These logs are fresh since I have used those tools. Hope I did this correct, I am trying to follow the stickies.

Here's the MBAM Log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4659

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

20/09/2010 6:30:06 PM

mbam-log-2010-09-20 (18-30-06).txt

Scan type: Quick scan

Objects scanned: 135522

Time elapsed: 6 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here's the DDS log, and attached is the GMER Rootkit logs.

DDS (Ver_10-03-17.01) - NTFSx86

Run by user at 17:55:03.61 on 20/09/2010

Internet Explorer: 8.0.6001.18943

Microsoft

attach.zip

[kahdah]

Hello scarecrowman

Welcome to Malwarebytes.

=====================

I see you have run Combofix see if the log is located here C:\Combofix.txt

If not hen do the following:

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
• Double click on ComboFix.exe & follow the prompts.
  

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[scarecrowman]

Thanks Kahdah,

Yes I did run a combofix as part of a suggestion from another website to remove the spamweblist[dot]com/block.php.

I have disabled/uninstalled all other tools (since the scans).

Here is my combofix log:

ComboFix 10-09-20.01 - user 20/09/2010 16:29:17.1.2 - x86

Microsoft

[kahdah]

One or more of the identified infections is a backdoor trojan or rootkit.

This type of infection has the capabilities to allows hacker to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identity Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

If you still want to clean it please do the following

===================

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

========

[scarecrowman]

Thank you again, kahdah.

That was my first task. I have disconnected it from the Internet, only connecting to update virus definitions before a scan. I will be recommending a format to the user, and I am confident that he will agree.

We will be formatting this computer, but I still do appreciate your assistance with this problem.

P.S.

I'm glad to see you guys have come so far. I was (still am) a Moderator over at windowsforum.org and I remember when we saw the first few posts about a brand new beta program called Malwarebytes. I remember this program in it's infancy, and am so happy to see how far it, as well as the community, has come.

You are all gentlemen (and women) and scholars.

Keep up the good work.

[kahdah]

You are welcome and thank you for the kind words.

Safe surfing