Infested w. Virtumonde, Mebroot, TDSServ, Spyware Guard 2008

My bad - had a syntax error.

I did not run Combofix /u yet.

GOOD

Right click upload.bat and choose edit, copy and paste this then save:

@ECHO OFF

::

:: As requested in the following thread:

:: http://malwareremoval.com/forum/viewtopic.php?p=382225#p382225

::

:: Pleased to serve you :-)

::

::

::    ~ Odd dude

::

FOR %%G IN (





c:\qoobox\quarantine\c\windows\system32\awtUKabx.dll.vir







C:\Qoobox\Quarantine\C\windows\system32\sufabuwu.exe.vir

C:\Qoobox\Quarantine\C\windows\system32\tipenuno.exe.vir

C:\Qoobox\Quarantine\C\windows\system32\nulapawa.exe.vir

C:\Qoobox\Quarantine\C\windows\system32\zotemiso.exe.vir





) DO Zip.exe -Sq UploadThis %%G

Zip.exe -mq UploadThis %0

Then rerun upload.bat

It should work fine now...
Please upload the zip as instructed in my previous post.
Let me know you have uploaded the file and then you can run combofix /u

Thank you for being so cooperative. You are one of the most helpful users I have ever encountered

That script worked & I uploaded the zip file per your instructions. I've got some errands to run now, so I'll uninstall ComboFix later today.

Thanks once again for all your help. Before this incident, I had no idea how sophisticated malware has grown. I have a lot of respect for people like you who fight it by developing countermeasures & guiding people like me through recovery.

One more question: can/should I also remove SmitfraudFix.exe and GMER?

Thanks once again for all your help. Before this incident, I had no idea how sophisticated malware has grown. I have a lot of respect for people like you who fight it by developing countermeasures & guiding people like me through recovery.

No problem

One more question: can/should I also remove SmitfraudFix.exe and GMER?

You can delete smitfraudfix.exe

Click start>run and copy and paste this:

gmer_uninstall

Then click OK and delete gmer.exe

All done. Thanks for your lifesaving assistance, OD. I used the "Support Us" tab above to make a paypal donation to the site.

No problem.

By the way, you should update your Adobe Reader. Yours is still version 7.

kstubbs,