You're Ready for cleaning.

At CastleCops we screen all HijackThis logs for errors, out-of-date versions, unupdated operating systems, omissions and P2P applications; getting you [READY] for cleaning by our 1st Responders and Security Experts. Now you wait for one of them to come help you.

Hello,
I'll be your handler. Kindly follow my guidance, and if it occurs, those of CC moderator or Admin.
Do not make changes, additions to your system without my guidance, nor run or get programs on your own, while we are attempting to remove malware & while this case is open.

I note you have run Combofix on your own. To re-emphasize, kindly do NOT run tools on your own.
You need guided help.

The following will just get us a report on the system (beyond the cleanup of temp files).
1. Set Windows to show all files and all folders. This is a must do when removing malware.

Check the Windows Explorer "View" options --- set it to show you all folders; all system folders; & hidden files.
Bring up Windows Explorer / Tools / Folder Options/ select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.
Next, un-check Hide extensions for known file types.
Next un-check Hide protected operating system files.

2. Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.

This program is for XP and Windows 2000 and Vista


• Double-click ATF-Cleaner.exe to run the program.
  
• Under Main choose: Select All
  
• Click the Empty Selected button.
  
  
• If you use Firefox browser:
  
  
  • Click Firefox at the top and choose: Select All
    
  • Click the Empty Selected button.
    
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  
• If you use Opera browser:
  
  
  • Click Opera at the top and choose: Select All
    
  • Click the Empty Selected button.
    
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  
• Click Exit on the Main menu to close the program.

ATF-Cleaner should be run per the above in every User Profile!

For Technical Support, double-click the e-mail address located at the bottom of each menu.
=
3. Next, Download Deckard's System Scanner: http://www.techsupportforum.com/sectools/Deckard/dss.exe

• Close all applications and windows.
  
• Double-click on dss.exe to run the application; follow the prompts.
  
• When the scan is completed, a text file named Main.txt will open. Please save this file, then close Notepad.
  
• The folder C:\Deckard also will open. This folder will contain another text file named Extra.txt. Please save this file to your desktop, too, then exit Notepad.

Note: Your firewall may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

In a reply to this thread, please post (in order): the contents of Main.txt and Extra.txt (from above).

Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer (& or any other browser) is closed when you click Fix Checked!
>
Please download the attached file named CFScript.txt and Save it to your Desktop. You do that by doing a RIGHT-Click on the Download {under the paperclip} and selecting SAVE Target As ..
Then point the desired location to your DESKTOP, and name the file CFScript.txt.
Do not double-clik the link to start download. Doing that will result in an unusable text file.

If you are not this member, do NOT follow these directions as they could damage the workings of your system.

Delete any prior copy of ComboFix and download a fresh copy. We always need the latest version.

Download and SAVE ComboFix to your Desktop Do NOT run the program straight away from download.

Download this file -- And RENAME it to Combo-fix.exe from either of these two sources:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe


Referring to the picture above, drag CFScript.txt onto ComboFix.exe (on your Desktop)

• Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  
• A window may open with a warning. Type "1" (and Enter) to start the fix. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

When finished, it will produce a log for you at C:\ComboFix.txt which I will need in your next reply.

* Note: The above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
>
Please perform this online scan: F-Secure Online Scanner

The online scanner is on the bottom right of the page.
Follow the directions in the F-Secure page for proper Installation.
You may receive an alert on the address bar at this point to install the ActiveX control.
Click on that alert and then click "Install ActiveX component".
Read the license agreement and click "Accept".
Click "Custom Scan" and be sure the following are checked:

• Scan whole System
  
• Scan all files
  
• Scan whole system for rootkits
  
• Scan whole system for spyware
  
• Scan inside archives
  
• Use advanced heuristics

When the scan completes, click the "I want to decide item by item" button.
For each item found, Select "Disinfect" and click "Next".
When done, click the "Show Report" button, then copy and paste the entire report into your next reply
>
Start HijackThis, do a Scan and Save report.

In a reply to this thread, please post (in order):

• the ComboFix.txt report and
  
• the F-Secure report, and
• the new HJT report,
• and tell us, How is your system now

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You'll likely have to do more than 1 reply.

All times are GMT