Quote:

---

Killall::


Folder::
C:\WINDOWS\cGV0ZXI
C:\n.bat
C:\WINDOWS\system32\iDlo18

File::
C:\WINDOWS\system32\swueuyjr.dll
C:\WINDOWS\system32\qcntskwb.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windownt\currentversion\winlogon\notify\iifghii]
[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\BMa75862e2]
[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\ExploreUpdSched]

---

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.




Refering to the picture above, drag CFScript.txt into ComboFix.exe

Restart your computer.

When finished, it shall produce a log for you at C:\ComboFix.txt

Then :-

Please download the trial version of AVG Anti-Spyware. from
here.
Install it and
update the program with the latest definitions.

Reboot your computer in "SAFE MODE" using the F8 method.
To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with AVG Anti-Spyware as follows:

• Click on the "Scanner" button and choose the "Settings" tab.
  
• Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
  
• Under "How to Scan?", "Possibly unwanted software", and What to Scan?" leave all the default settings.
  
• Under "Reports" select "Do not automatically generate reports".
  
• Click the "Scan" tab to return to scanning options.
  
• Click "Complete System Scan" to start.
  
• When the scan has finished, it should automatically be set to Quarantine--if not click on Recommended Action and set it there.
  
• You will also be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the :Apply all actions button.
If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report.
So be sure you save it only AFTER clicking the "Apply all actions" button.

• Click on "Save Report" to view all completed scans. Click on the most recent scan you performed, select "Save report as" and save to your desktop.
  The default file name will be in date/time format: Report-Scan-200706-1606.
  A copy of each report will be saved in C:\Documents and Settings\<user profile>\Application Data\Grisoft\AVG Antispyware 7.5\Reports.
  
• If you installed AVG AS over a previous version, reports are saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
  
• If you are a Vista user, reports are saved in C:\Users\<username>\AppData\Roaming\Grisoft\AVG Antispyware 7.5\Reports\

Exit AVG Anti-Spyware when done, reboot normally and post the AVg log report and a new HijackThis log along with the ComboFix.txt.



Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please and
let me know how it is running.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*

--------------------
MY HELP IS FREE,BUT PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST SPYWARE.

You don't stop laughing when you get old, you get old when you stop laughing!

Post Extras:

Quote:

---

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please and
let me know how it is running.

---

Quote:

---

[-HKEY_LOCAL_MACHINE\software\microsoft\windowsnt\currentversion\winlogon\notify\iifghii]
[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\BMa75862e2]
[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\ExploreUpdSched]

---

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.




Refering to the picture above, drag CFScript.txt into ComboFix.exe

Restart your computer.

When finished, it shall produce a log for you at C:\ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please and
let me know how it is running.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*

--------------------
MY HELP IS FREE,BUT PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST SPYWARE.

You don't stop laughing when you get old, you get old when you stop laughing!

Post Extras: