Windows XP- Constant Virus infections + Spyware

[neha]

Hi, I was trying to help out my cousin with her computer as it appears they keep getting fake antivirus programs installed. Believe its primarly due to the gaming sites her brother uses.

Recently she called me up to see if I might be able to help her remove the program "Antimaleware Doctor" and "OfferBox" from her computer.

Looked up the steps in cleaning it up using Malwarebytes and performed the task. I have used Malwarebytes in the past with no problems.

The issue is, when running Malwarebytes and removing the items found on her computer, the internet stops working. Can not access any sites. Also, upon restarting the computer (eg. shut down and the starting the computer the next day or so) the virus is back. Believe the problem may be worse as there have been other issues.

I do have access to get onto her computer during the day, so would appreciate if someone could guide me on what to do.

I would like to know which software/programs etc I would need to download prior to getting on her computer in case there is a problem downloading them on her system (can dl them on my comp and put them on usb)

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

Next,

• download the file TDSSKiller.zip and extract it into a folder on the infected PC.
  
• Execute the file TDSSKiller.exe by double-clicking on it.
  
• Wait for the scan and disinfection process to be over.
  
• When its work is over, the utility prompts for a reboot to complete the disinfection.

By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).

The log is like UtilityName.Version_Date_Time_log.txt.

for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.

Please post that log here.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317