andyspeake
Hi, http://forums.techguy.org/malware-remov ... ction.html
Quite a few bad infections in there/where there.
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\qiawpbjj.exe,C:\WINDOWS\system32\userinit.exe - CF Should get rid of that. Also all those orphaned 02's will be removed by CF as well, if not i'll get it manually!
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://real.gamehouse.com/games/beje...pcaploader.cab - I'll get that removed via HJT
O21 - SSODL: E404Helper - {6ac876c3-287e-4ec2-82a1-014d3650f3f5} - e404d.dll (file missing) - http://www.bleepingcomputer.com/forums/topic123050.html - This might still be in there(I believe it may have already been removed by OP), Cf might get that when i run it for the F2 entry, if not, then Smitfraud should get it as explained it that bleeping computer link.
User has not update to SP3 and java seems outdated.
========================
Hi,
Download and Run ComboFix
Please visit this webpage for instructions for downloading ComboFix at your DESKTOP :
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
Additional links to download the tool:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
Quite a few bad infections in there/where there.
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\qiawpbjj.exe,C:\WINDOWS\system32\userinit.exe - CF Should get rid of that. Also all those orphaned 02's will be removed by CF as well, if not i'll get it manually!
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://real.gamehouse.com/games/beje...pcaploader.cab - I'll get that removed via HJT
O21 - SSODL: E404Helper - {6ac876c3-287e-4ec2-82a1-014d3650f3f5} - e404d.dll (file missing) - http://www.bleepingcomputer.com/forums/topic123050.html - This might still be in there(I believe it may have already been removed by OP), Cf might get that when i run it for the F2 entry, if not, then Smitfraud should get it as explained it that bleeping computer link.
User has not update to SP3 and java seems outdated.
========================
Hi,
Download and Run ComboFix
Please visit this webpage for instructions for downloading ComboFix at your DESKTOP :
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
Additional links to download the tool:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. A guide to do this can be found here.
- Click Yes to allow ComboFix to continue scanning for malware.
- When the tool is finished, it will produce a report for you.
- Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.
