Inactive Cant do a system restore.

broni · 2010/12/23

Make sure, you cure them.

When done....

Download Bootkit Remover to your Desktop.

You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/

After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.

It will show a Black screen with some data on it.

Right click on the screen and click Select All.

Press CTRL+C

Open a Notepad and press CTRL+V

Post the output back here.

Davidx510 · 2010/12/23

i'm still stucked on how to cure it. look at this picture.

please reply my computer is also automatically restarting by itself

broni · 2010/12/23

For now, simply click on "Apply" button and proceed with my previous reply.

Davidx510 · 2010/12/23

okay, thanks for the reply .

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00
Boot sector MD5 is: 75152e63358aab67ac253ae2f28ef97a

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Done;
Press any key to quit...

broni · 2010/12/23

Yeah, we have to fix your MBR....

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

Place a blank CD in your CD drive.

Double click on NTBR_CD.exe file and a folder of the same name will appear.

Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.

Follow the prompts to burn the CD.

Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)

If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.

Insert the newly created CD into your infected PC and reboot your computer.

Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!

Read the warning and then continue as prompted.

You first need to select your keyboard layout - press Enter for English.

Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK

On the following screen enter 5 to select Install Standard MBR code.

Enter 1 to overwrite the infected MBR Code with the Standard MBR code.

When asked to confirm please do so.

Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.

Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted, run MBRCheck again and post its log.

Davidx510 · 2010/12/23

omg i put in numerous of "blanks" cd but it keeps saying "please insert a blank cd into the drive... help me

broni · 2010/12/23

OK, we'll get back to it in a moment.

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Davidx510 · 2010/12/23

ComboFix 10-12-23.02 - guestt 12/23/2010 15:20:55.4.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.770 [GMT -8:00]
Running from: c:\documents and settings\guestt\Desktop\davidchor.exe.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\guestt\Application Data\Gesi
c:\documents and settings\guestt\Application Data\Gesi\ozaw.exe
c:\program files\whitesmoketoolbar\whITesmoketoolbarx.dll

c:\windows\regedit.exe . . . is infected!!

-- Previous Run --

c:\windows\regedit.exe . . . is infected!!

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

c:\windows\regedit.exe . . . is infected!!

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

c:\windows\explorer.exe . . . is infected!!

c:\windows\regedit.exe . . . is infected!!

-- Previous Run --

c:\windows\regedit.exe . . . is infected!!

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

c:\windows\regedit.exe . . . is infected!!

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

c:\windows\explorer.exe . . . is infected!!

--------

c:\windows\explorer.exe . . . is infected!! . . .Failed to restore. Attempting to replace on reboot

--------

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
.

2010-12-23 20:56 . 2010-12-23 20:58 -------- d-----w- c:\documents and settings\guestt\Local Settings\Application Data\Temp
2010-12-23 20:55 . 2010-09-07 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-12-23 20:55 . 2010-09-07 15:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-12-23 20:55 . 2010-09-07 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-12-23 20:55 . 2010-09-07 15:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-12-23 20:55 . 2010-09-07 15:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-12-23 20:55 . 2010-09-07 15:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-12-23 20:55 . 2010-09-07 15:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-12-23 20:55 . 2010-09-07 16:12 38848 ----a-w- c:\windows\avastSS.scr
2010-12-23 20:55 . 2010-09-07 16:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-12-23 20:55 . 2010-12-23 20:55 -------- d-----w- c:\program files\Alwil Software
2010-12-23 20:55 . 2010-12-23 20:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-12-23 06:12 . 2010-12-23 06:12 -------- d-----w- c:\documents and settings\guestt\Application Data\whitesmoketoolbar
2010-12-23 05:26 . 2010-12-23 21:58 -------- d-----w- c:\documents and settings\guestt\Application Data\Ruoti
2010-12-23 04:18 . 2010-12-23 04:18 -------- d-----w- c:\windows\system32\%APPDATA%
2010-12-23 04:18 . 2010-12-23 04:18 -------- d-----w- c:\documents and settings\NetworkService\Application Data\whitesmoketoolbar
2010-12-23 04:18 . 2010-12-23 23:27 -------- d-----w- c:\program files\whitesmoketoolbar
2010-12-22 19:06 . 2010-12-22 19:06 -------- d-s---w- c:\documents and settings\LocalService\UserData
2010-12-22 18:13 . 2010-12-22 18:13 -------- d-----w- c:\documents and settings\guestt\Application Data\Malwarebytes
2010-12-22 18:13 . 2010-12-22 18:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-22 18:13 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-22 18:13 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-22 18:13 . 2010-12-22 18:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-22 05:32 . 2010-12-22 05:32 -------- d-----w- c:\documents and settings\guestt\Application Data\DriverCure
2010-12-22 05:32 . 2010-12-22 05:32 -------- d-----w- c:\documents and settings\guestt\Application Data\ParetoLogic
2010-12-22 05:32 . 2010-12-22 05:53 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-12-21 23:47 . 2010-12-21 23:58 -------- d-----w- c:\program files\Registry Easy
2010-12-21 23:40 . 2010-12-21 23:46 -------- d-----w- c:\program files\RegQuick
2010-12-21 23:31 . 2010-12-21 23:31 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2010-12-21 22:21 . 2010-12-21 22:21 -------- d--h--w- c:\windows\system32\GroupPolicy
2010-12-21 20:50 . 2010-12-23 06:42 -------- d-----w- c:\windows\system32\NtmsData
2010-12-21 08:37 . 2010-12-21 08:37 210432 ----a-w- c:\windows\Xtycea.exe
2010-12-21 08:37 . 2010-12-21 08:37 126464 --sha-r- c:\windows\system32\atiiiexxr.dll
2010-12-21 08:35 . 2010-12-21 08:35 0 ----a-w- c:\windows\Qbubuciv.bin
2010-12-21 08:34 . 2010-12-23 23:31 763392 ----a-w- c:\windows\system32\drivers\bmwaqk.sys
2010-12-21 01:45 . 2010-12-21 01:45 -------- d-----w- c:\program files\Yontoo Layers Client
2010-12-21 01:45 . 2010-12-21 01:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer
2010-11-30 05:50 . 2010-11-30 05:50 -------- d-----w- C:\Download
2010-11-30 05:49 . 2010-11-30 05:50 -------- d-----w- C:\tmpDownload
2010-11-30 05:49 . 2010-11-30 05:52 -------- d-----w- C:\YoutubeMusicDownloader
2010-11-30 05:40 . 2010-11-30 05:49 -------- d-----w- c:\documents and settings\guestt\Local Settings\Application Data\DownloadYoutubeMusic
2010-11-24 06:12 . 2010-11-24 06:12 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-11-24 06:09 . 2010-11-24 06:12 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-07 20:23 . 2010-10-07 20:23 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-10-07 20:23 . 2010-10-07 20:23 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2010-10-07 20:23 . 2010-10-07 20:23 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-10-07 20:23 . 2010-10-07 20:23 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-09-28 23:44 . 2010-11-17 06:17 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-09-28 23:44 . 2007-11-14 02:23 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2008-01-29 05:45 . 2007-11-27 12:34 131584 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

------- Sigcheck -------

[7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . 561C813B4A9D1C9EDA44D206C975AE83 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2004-08-10 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2008-04-14 . D48CA05F47ADA53E8FC0824C318CECD8 . 975872 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 . 9784E0719124E4A23989AEF9E7CA02D6 . 975360 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2004-08-10 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

[-] 2008-04-14 . AAC9DAE0E7C43BD26C43FC7436E2F1B0 . 832512 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\iexplore.exe
[7] 2007-10-10 . 632BDE0179847234433CA50945442ACB . 625664 . . [7.00.6000.20696] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe
[7] 2007-08-17 . 5577D0E3AC2F9F035ACD81B44AF5F511 . 625152 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe
[7] 2007-06-27 . BD8502DFD53FC24FB8D6929DC46B8C2C . 625152 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
[-] 2004-08-10 . E7484514C0464642BE7B4DC2689354C8 . 93184 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\iexplore.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} "= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-09-12 66912]

[HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-09-12 06:03 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440} "= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RealUpgradeHelper "= "c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-10-18 136768]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
axymv.exe [2010-12-22 167424]

c:\documents and settings\Guest\Start Menu\Programs\Startup\
leitav.exe [2010-12-22 167424]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
hove.exe [2010-12-22 167424]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C:\0lsdelete

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Danny Chor^Start Menu^Programs^Startup^RocketDock.lnk]
backup=c:\windows\pss\RocketDock.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-28 00:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2010-12-06 04:50 2356088 ----a-w- c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2010-05-26 18:03 2346192 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
2009-05-19 05:23 49968 ----a-w- c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
2007-01-19 18:49 49152 ----a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2005-08-06 03:05 344064 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Wireless G WUA-1340]
2007-08-27 23:25 1662976 ----a-w- c:\program files\D-Link\Wireless G WUA-1340\AirGCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 18:09 460784 ----a-w- c:\program files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-05-21 18:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax]
2010-03-01 21:00 9216928 ----a-w- c:\program files\Innovative Solutions\DriverMax\devices.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax_RESTART]
2010-03-01 21:00 9216928 ----a-w- c:\program files\Innovative Solutions\DriverMax\devices.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2007-11-15 17:24 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 22:19 53248 ------w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-09-29 20:01 67584 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON NX100 Series]
2008-02-04 21:00 188928 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIEDA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-01-29 05:45 29744 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 20:39 1289000 ----a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-06-10 16:44 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-11-11 08:40 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2007-10-30 22:48 67128 ----a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
2005-05-20 21:46 28160 ----a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-07-13 01:05 1117184 ----a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PD0620 STISvc]
2005-05-11 09:03 36864 ----a-w- c:\windows\system32\P0620Pin.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 19:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryQuick.exe]
2010-09-04 07:54 4019200 ----a-w- c:\program files\RegQuick\RegistryQuick.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2005-03-23 05:20 339968 ----a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 21:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2007-11-20 22:02 356352 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 12:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tbhSystray]
2010-12-23 19:50 492840 ----a-w- c:\program files\tbh\base\bin\tbhSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-18 02:21 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications "= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Avant Browser\\avant.exe "=
"c:\\Program Files\\AIM6\\aim6.exe "=
"c:\\StubInstaller.exe "=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe "=
"c:\\Program Files\\Motorola Phone Tools\\mPhonetools.exe "=
"c:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe "=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe "=
"c:\\Program Files\\FrostWire\\FrostWire.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\ijji\\ENGLISH\\u_sf.exe "=
"c:\\ijji\\ENGLISH\\ijjiPurpleOutBound.exe "=
"c:\\WINDOWS\\Downloaded Program Files\\PurpleBean.exe "=
"c:\\Program Files\\SightSpeed\\SightSpeed.exe "=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\program files\Microsoft ActiveSync\rapimgr.exe "= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe "= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe "= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe "=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe "=
"c:\\Program Files\\tbh\\base\\bin\\tbhDaemon.exe "=
"c:\\Program Files\\tbh\\monitor\\bin\\tbhMonitor.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe "=
"c:\\WINDOWS\\Downloaded Program Files\\ijjiOptimizer.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\ijji\\ijji REACTOR\\ijjiOptimizer.exe "=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe "=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP "= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5191:TCP "= 5191:TCP:The Browser Highlighter XCOM
"57769:TCP "= 57769:TCPando Media Booster
"57769:UDP "= 57769:UDPando Media Booster

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/23/2010 12:55 PM 165584]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/23/2010 12:55 PM 17744]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/23/2010 12:56 PM 136176]
S2 tbhMonitor.exe;The Browser Highlighter Monitor;c:\program files\tbh\monitor\bin\tbhMonitor.exe [10/22/2009 1:57 PM 70952]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/16/2009 9:37 PM 24652]
S3 Angel;Angel MPEG Device;c:\windows\system32\drivers\Angel.sys [3/17/2006 12:46 AM 375936]
S3 asbp2poa;asbp2poa;\??\c:\docume~1\DANNYC~1\LOCALS~1\Temp\asbp2poa.sys --> c:\docume~1\DANNYC~1\LOCALS~1\Temp\asbp2poa.sys [?]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 9:58 AM 11336]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/27/2007 4:34 AM 29744]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/22/2010 10:13 AM 38224]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ZD1211BU(WLAN);IEEE 802.11g USB Wireless LAN(WLAN);c:\windows\system32\drivers\ZD1211BU.sys [2/22/2009 10:34 AM 402432]
S3 ZD1211U(WLAN);IEEE 802.11g USB Wireless LAN Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [7/22/2008 7:48 AM 247296]

--- Other Services/Drivers In Memory ---

*Deregistered* - bmwaqk

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-11-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 19:50]

2010-12-23 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2010-06-05 21:11]

2010-12-23 c:\windows\Tasks\Game_Booster_Startup.job
- c:\program files\IObit\Game Booster 2\GameBox.exe [2010-11-07 03:08]

2010-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-23 20:56]

2010-12-21 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-05 00:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.babylon.com/home?AF=10191
uInternet Settings,ProxyOverride = *.local
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {AC12BE9A-2B60-4542-A6AA-210CAD210760} = 208.67.222.222,0.0.0.0
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\guestt\Application Data\Mozilla\Firefox\Profiles\gq03x6kz.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://utils.babylon.com/abt/index.php?url=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension for Firefox: {B13721C7-F507-4982-B2E5-502A71474FED} - c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Shop to Win: {5835466c-49af-4cbe-b102-a8c8b6313749} - %profile%\extensions\{5835466c-49af-4cbe-b102-a8c8b6313749}
FF - Ext: Autofill Forms: autofillForms@blueimp.net - %profile%\extensions\autofillForms@blueimp.net
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-{63D32AD0-AA7D-B33D-425E-6D3CE9FC5E30} - c:\documents and settings\guestt\Application Data\Gesi\ozaw.exe
MSConfigStartUp-{63D32AD0-AA7D-B33D-425E-6D3CE9FC5E30} - c:\documents and settings\guestt\Application Data\Gesi\ozaw.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-23 15:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath "= "c:\windows\system32\GameMon.des -service "

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\bmwaqk]

.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(676)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(592)
c:\windows\system32\ntshrui.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
Completion time: 2010-12-23 15:37:12 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-23 23:37
ComboFix2.txt 2010-12-21 09:30

Pre-Run: 111,361,368,064 bytes free
Post-Run: 111,417,389,056 bytes free

- - End Of File - - 75F0854E2E26D3BAEDD6D079358D3598

Davidx510 · 2010/12/23

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 12/23/2010 at 15:16:34.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

Rkill completed on 12/23/2010 at 15:16:37.

broni · 2010/12/23

OK, we more serious issues here....

Do you have Windows XP CD?

Davidx510 · 2010/12/23

i'm sorry i think i losted it ..

broni · 2010/12/23

Download zipped explorer.exe and winlogon.exe files from here: http://www.smartestcomputing.us.com/files/file/1-windows-xp-explorerexe-and-winlogonexe/ (safe, from my computer).

Unzip both files and paste both UNzipped files in C:\ directory.

I need to see, if you did it right, so....

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64-bit users go HERE
Double-click SystemLook.exe to run it.

Vista users:: Right click on SystemLook.exe, click Run As Administrator
Copy the content of the following box into the main textfield:
Code:
:filefind
explorer.exe
winlogon.exe
Click the Look button to start the scan.

When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Davidx510 · 2010/12/23

thankyou for still helping me

SystemLook 04.09.10 by jpshortstuff
Log created at 16:17 on 23/12/2010 by guestt
Administrator - Elevation successful

========== filefind ==========

Searching for "explorer.exe "
C:\explorer\explorer.exe --a---- 1033728 bytes [00:16 24/12/2010] [13:42 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923
C:\WINDOWS\explorer.exe --a---- 975872 bytes [10:18 16/08/2005] [00:12 14/04/2008] D48CA05F47ADA53E8FC0824C318CECD8
C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe --a---- 1033216 bytes [11:26 13/06/2007] [11:26 13/06/2007] 7712DF0CDDE3A5AC89843E61CD5B3658
C:\WINDOWS\$NtServicePackUninstall$\explorer.exe --a--c- 975360 bytes [04:28 23/10/2008] [10:23 13/06/2007] 9784E0719124E4A23989AEF9E7CA02D6
C:\WINDOWS\$NtUninstallKB938828$\explorer.exe --a--c- 1032192 bytes [23:06 30/08/2007] [11:00 10/08/2004] A0732187050030AE399B241436565E64
C:\WINDOWS\ServicePackFiles\i386\explorer.exe --a---- 975872 bytes [06:58 12/09/2008] [00:12 14/04/2008] 561A50497324F378E30F55D09B4E1258

Searching for "winlogon.exe "
C:\i386\winlogon.exe --a---- 502272 bytes [00:50 30/08/2007] [11:00 10/08/2004] 01C3346C241652F43AED8E2149881BFE
C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe --a--c- 502272 bytes [04:27 23/10/2008] [11:00 10/08/2004] 01C3346C241652F43AED8E2149881BFE
C:\WINDOWS\ServicePackFiles\i386\winlogon.exe ------- 507904 bytes [07:01 12/09/2008] [00:12 14/04/2008] ED0EF0A136DEC83DF69F04118870003E
C:\WINDOWS\system32\winlogon.exe --a---- 507904 bytes [10:18 16/08/2005] [00:12 14/04/2008] 561C813B4A9D1C9EDA44D206C975AE83
C:\winlogon\winlogon.exe --a---- 507904 bytes [00:16 24/12/2010] [09:36 21/03/2008] B8135E9ED99A0858DF535CE0A0271558

-= EOF =-

broni · 2010/12/23

You're welcome

Be extremely careful, when performing the procedure listed below.
We'll be replacing crucial Windows file(s).
Watch for "spaces" in listed commands and make sure, there is no single misspelling.

Restart computer
When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.

(If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.)

You must enter which Windows installation to log onto. Type 1 and press enter.

It will then prompt you for the Administrator's password. If there is no password, simply press Enter.

You should get a black screen with a C:\>Windows prompt.

Type the bolded text below, pressing Enter after each line:
(If it asks you if you are sure then say "Y ".)

ren c:\windows\system32\winlogon.exe c:\windows\system32\winlogon.old (<---- watch for "spaces ")

copy c:\winlogon\winlogon.exe c:\windows\system32\winlogon.exe (<---- watch for "spaces ")

ren c:\windows\explorer.exe c:\windows\explorer.old (<---- watch for "spaces ")[/i]

copy c:\explorer\explorer.exe c:\windows\explorer.exe (<---- watch for "spaces ")

Reboot computer.

Post new SystemLook log.

Davidx510 · 2010/12/23

I keep getting "this parameter is not valid" ,i typing up everything and watched for the spaces, whats happening ..?

broni · 2010/12/23

You're not typing "(<---- watch for "spaces ")" are you?

Davidx510 · 2010/12/23

of course not lol. is there any other way to complete this task?

broni · 2010/12/23

Yes...

Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.

Reboot your system using the boot CD you just created.

Note : If you do not know how to set your computer to boot from CD follow the steps here

Your system should now display a REATOGO-X-PE desktop.

Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.

Double-click on the OTLPE icon.

When asked Do you wish to load the remote registry, select Yes

When asked Do you wish to load remote user profile(s) for scanning, select Yes

Ensure the box Automatically Load All Remaining Users" is checked and press OK

OTL should now start.

Under the Custom Scan box paste this in:

/md5start
explorer.exe
winlogon.exe
/md5stop

Press Run Scan to start the scan.

When finished, the file will be saved in drive C:\OTL.txt

Copy this file to your USB drive if you do not have internet connection on this system

Please post the contents of the OTL.txt file in your reply.

Davidx510 · 2010/12/23

okay while i'm downloading the file um let me ask you this, i'm doing everything in safe mode right now and when i log on to the regular window it will automatically restart the computer.. do you know why?? it doesn't restart itself in safemode..

broni · 2010/12/23

That's definitely the infection causing havoc.

Log in or Sign up

Inactive Cant do a system restore.

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Inactive Cant do a system restore.

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Davidx510 Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches