#16
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/malware-virus-removal/80304-active-infected-trojan-virus-windows-will-not-boot-anymore.html#post437465
Collect::
c:\windows\system32\drivers\ldznxx.sys
c:\windows\system32\tuvWopnn.dll
c:\windows\system32\stu2.exe
Folder::
c:\program files\tintinyproxyy
c:\windows\system32\994D46E4DC061202
Driver::
bnrgaeki
ezmevcc
flkuzsm
gvrwpn
hgidlvrp
ingzlb
mbrme
mqafxk
qjlg
ttzn
994D46E4DC061202 Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log here.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall. **NOTE - I recommend you allow the Recovery Console to be downloaded and installed if or when prompted.
#17
Member
Profile: Join Date: Dec 2008
Posts: 11
Computer Experience:
here is the combofix log file.i did not receive any prompt to upload a zip file tho.i did install the recovery tool.Infected copy of c:\windows\system32\userinit.exe was found and disinfected ftp .exe"=TCP "= 8317:TCP :BitComet 8317 TCP TCP "= 3389:TCP :@xpsp2res.dll,-22009js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - hxxp://handsomeboys.org/http://www.gmer.net SP2 -Pro-BootDisk-ENU.exe
#18
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Please post the contents of C:\Qoobox\ComboFix-quarantined-files.txt
#19
Member
Profile: Join Date: Dec 2008
Posts: 11
Computer Experience:
here it is.
#20
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Please upload the following file to this submission channel .Kaspersky Online Scanner Accept , when prompted to download and install the program files and database of malware definitions.Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note** Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
#21
Member
Profile: Join Date: Dec 2008
Posts: 11
Computer Experience:
here is the new log file.
#22
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Good sign indeed! ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well. Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.
#23
Member
Profile: Join Date: Dec 2008
Posts: 11
Computer Experience:
hello
#24
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Good work gekostar! Geri has posted some very helpful information and recommendations regarding future protection in the following link.An ounce of prevention is worth a pound of cure
All times are GMT +1. The time now is 12:46 .
