trojan horse cryptic.fj

[n00bster]

Hello!

Computer is messing up! I created a thread earlier, but wasnt able to deal with it so I have to create a new one.

http://forums.malwarebytes.org/index.php?showtopic=79188&st=0&p=405373entry405373 <-----that was the one earlier. I finally got the Product Recovery CD-ROM. I hope that will do.

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[n00bster]

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Andmebaasi versioon: 6566

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

13.05.2011 10:54:40

mbam-log-2011-05-13 (10-54-40).txt

Kontrolli t

Attach.rar

[screen317]

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[n00bster]

I did all the parts, but even if I disabled my AVG, ComboFix said that it cant perform, because ACG is targeting its files and this could be dangerous. I removed AVG and then ComboFix was successful until it was doing autoscan.

Screen was like that:

Scanning for infected files...

This typically doesn`t take more than 10 minutes

However, scan times for badly infected machines may easily double

T was unexpected at this time.

_

I waited for 1,5hrs with that screen and I didnt do anything with the computer, but the program didnt do anything so i closed it. What should I do now?

[screen317]

Grab a fresh copy of ComboFix and save it to your Desktop. Do not run it yet. When you download it, call it noob.com

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Click Start --> Run, and enter this command:

"%userprofile%\desktop\noob.com" /killall /nombr

See if it will run now.

[n00bster]

Downloaded new ComboFix and named it noob.com, went to Safe Mode ->start menu -> run

"%userprofile%\desktop\noob.com"/killall/nombr

It said that it couldnt find it.

[screen317]

Hi,

Do you see noob.com on your Desktop? Ensure the spaces are there in the correct places (copy and paste the command to ensure it's correct).

[n00bster]

Yes, I can see noob.com in my desktop and i have ensured that spaces are in the correct place (copy-pasted the command), but still it cant find it.

It says in the bleepingcomputer.com that:

"At this time ComboFix can only run on the following Windows versions:

Windows XP (32-bit only)". Maybe my windows isnt 32-bit.

[screen317]

Hi,

Enter it again, except before you press Enter, copy and paste what you wrote into your reply here.

[n00bster]

"%userprofile%\desktop\noob.com" /killall /nombr <-----i wrote that!

[screen317]

Hi,

Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet (rename it to noob.com again).

Next, please open Notepad - don't use any other text editor than notepad or the script will fail.

Copy/paste the text in the box below into Notepad:

KILLALL::
NOMBR::

Save this as CFScript

Then drag the CFScript into noob.com as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new DDS log.

-screen317

[n00bster]

Now the PC is going mental, it wont even start.

It says that windows did not start successfully and asks if i want to start in: safe mode, start normally or choose last known good configuration.

If i choose:

1) start normally or 2) last known good configuration, it gets to windows logo, stays there for a bit and then restarts. Pretty much the same with choosing safe mode. It just restarts.

[screen317]

Yikes.

Do you have your Windows CD?

These are links to Anti-virus vendors that offer free LiveCD or Rescue CD files that are used to boot from for repair of unbootable and damaged systems, rescue data, scan the system for virus infections. Burn it as an image to a disk to get a bootable CD. All (except Avira) are in the ISO Image file format. Avira uses an EXE that has built-in CD burning capability.

• Avira AntiVir Rescue System - Tutorial for Avira Rescue CD.
  If you encounter problems running the Rescue Disk, you can get further assistance at the Avira Support Forum.
  
• Dr Web LiveCD. Be sure to print out and follow the instructions provided in the User Manual.
  
• F-Secure Rescue CD - Rescue CD 3.01 released.
  Video: How to Remove Malware with F-Secure Rescue CD
  If you encounter problems running the Rescue CD, you can get further assistance at the F-Secure Support Forum.
  
• BitDefender LiveCD - Index of /rescue_cd
  If you encounter problems running the Rescue CD, you can get further assistance at the BitDefender Support Forum.
  
• Kaspersky RescueDisk - Index of /devbuilds/RescueDisk/
  If you encounter problems running the RescueDisk, you can get further assistance at the Kaspersky Support Forum.
  

If you are not sure how to burn an image, please read How to write a CD/DVD image or ISO. If you need a FREE utility to burn the ISO image, download and use ImgBurn.

Let me know how it goes.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!