This thread's last reply is from May 17, 2008, 6:25 AM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
Here's my log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:02:16 PM, on 5/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.
Hi pcmomnew
I'm Gary R, I'll be glad to help you with your computer problems.
Please observe these rules while we work:
Perform all actions in the order given.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with it till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
If you can do these things, everything should go smoothly.
If you're using XP, you'll need Administrator privileges to perform the fixes. (XP accounts are Administrator by default)
If you're using Vista, it will be necessary to right click all tools we use and select ----> Run as Admistrator
It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.
Your HijackThis log looks a little short, have you been removing anything with HijackThis ?
If you have
Double click HijackThis.exe to launch it.
Click Config > Backups
Check (tick) all entries in the white box.
Click Restore
Answer Yes when prompted.
Hit the Back button.
Now run a new scan and post me the log please.
If not
DownloadDeckard's System Scanner (DSS)to your Desktop. (Note: You must be logged onto an account with administrator privileges).
Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt<- this one will be maximized and extra.txt<-this one will be minimized
Copy/Paste the contents of main.txt and extra.txt into your next post please.
I had restarted without a full startup through msconfig. I went back to a normal boot, rescanned with hijackthis - and am posting the new log. Here it is:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:34:53 AM, on 5/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Reboot your computer into Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Note: if you cannot boot into safe mode using this method, DO NOT attempt to do so by using MSConfig, this could result in your computer becoming unbootable. Just let me know.
Once in safe mode.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste me the contents of Report.txt.
Next
Go to C:\Program Files\Trend Micro\HijackThis
Open the HijackThis folder
Rename the file HijackThis.exe to FredFlintstone.exe
Run a new scan with HJT (FredFlintstone) and send me the new log please.
I can restart into safe mode - but my keyboard is disabled - so when I try to type Y to run the batch file in SDFix, I can't do anything.
Is there another way get into safe mode that won't disable the keyboard. The problem may be that this is a partition of a MAC running Windows XP. Let me know what I should try.
Trying to restart in safe mode at first disabled the keyboard, so I couldn't run the batch file. I rebooted into normal mode to see if the keyboard worked there - and it does, but the mouse is now completely disabled - it's a USB mouse, and I don't have another pointing device (except a Bluetooth Wireless Mouse) - so I'm not sure what to do now!
OK, not sure why your keyboard's being disabled in Safe Mode, so we'll use a tool that doesn't require SM, just means we'll have a bit more work to do.
There are some new infections that damage your ability to boot if they are removed. So before we go any further, I need you to install Recovery Console to your computer. This is purely a precautionary measure, I don't see signs of them on your computer, but it's better to be a little cautious now than regretful later.
Recovery Console gives us the ability to recover your computer if things go wrong.
Download combofix.exeby sUBs to your Desktop (it must be in this location).
Alternate Download
If you already have a previous version, delete it and download a new version.
Go to Microsoft's website
Select the download that's appropriate for your Operating System (if you have XP Media Centre, use download for XP Pro)
Download the file & save it as it's originally named, to your Desktop.
Next
Disconnect from the Internet.
Important! Temporarily disable your anti-virus, and anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its files which may cause unpredictable results.
Click hereto see a list of programs that should be disabled (ignore the firewalls). The list is not all inclusive. If yours are not listed and you don't know how to disable them, please ask.
Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix.
When prompted, agree to the End-User License Agreement to install Microsoft Recovery Console.
When complete a mesage will pop up asking if you want to continue scanning for Malware.
Click Yes
Combofix will now run a scan. (Usually takes 15-20 mins, but could be slightly longer)
When finished, it will
Produce a log for you. (it can also be found at C:\Combofix.txt)
Post the log in your next reply please.
Now run a new HJT scan and send me the log from that as well please.
Don't forget to re-enable your anti-virus and anti-malware protection before re-connecting to the Internet.
IMPORTANT
Do not use your computer while Combofix is running.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
If you've lost your Internet connection when Combofix has completely finished, re-start your computer to restore it.
If you have any problems with these instructions, a detailed Tutorial for how to use Combofix is available here.
Re-formatting your disk and re-installing Windows will certainly clear your Malware problems.
Whether it will resolve the mouse problem I couldn't say, could be a hardware failure, it's impossible for me to say from here. Do you have access to another mouse that you can try?
If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.
If you have been helped and wish to donate to help with the costs of this volunteer site, please readDonations For Malware Removal
Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Gary R
✨ Ask AI about this thread
No ads, no affiliate links — generated on request from this thread's own
archived content, not written by forum staff. Never run a scan/removal tool
as a self-service step if the original thread describes it being done under
a helper's direct supervision, and don't include your name, email, or other
personal details in a follow-up question. See our privacy page
for details on how this works.
