TechSpot

Can't completely clean my system - logs attached

By gak27
Nov 11, 2007
  1. Greetings all!

    As requested, I have followed all the instructions and attached the following logs:

    - HJT
    - Combofix
    - AVG Antispyware

    The Panda Antirootkit scan found no unknown rootkits.

    Symptoms: When computer boots up (either in safe mode or normal) I get a message at the bottom right tray saying that I have files waiting to write to the CD, and to please click the balloon to see these files. After the system boots up, I get IE windows randomly popping up with nasty links. For awhile I was also having problems with the "Security Toolbar 7.1" issue but I seem to have solved this with a system restore action. The symptoms I described above are still happening. Any help will be most welcomed. Thank you for this site.

    Greg
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Delete all files in AVG Antispyware quarantine.

    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Code:



    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

    [​IMG]

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

    Please open notepad and and copy and paste next bold in it:
    (don't forget to copy and paste REGEDIT4)

    Save this as "fix.reg" Choose to save as *all files and place it on your desktop.

    Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

    Regards Howard :wave: :wave:

    This thread is for the use of gak27 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. gak27

    gak27 TS Rookie Topic Starter

    Howard,

    I just finished all of the steps you outlined above. I have attached the new HJT and Combofix logs. These were generated prior to running the fix.reg step (according to the order you outlined). Am I in better shape? Any other steps I need to take (I know you still need to look at the logs). I noticed that the "files waiting to be written to CD" balloon did not pop up on rebooting...do you know what I might have been infected with?

    Sincerely,

    Greg

    Edit: After rebooting the machine, the "CD" balloon reappeared...
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    All clean.

    Delete the following folder.

    C:\qoobox

    Your system was infected with a variety of malware, including the vundo trojan.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of gak27 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. gak27

    gak27 TS Rookie Topic Starter

    Howard,

    When I reboot the machine, I still get the "Files are waiting to be written to the CD. Click this balloon to see the files" balloon, along with a CD drive icon.
    Is this due to malware/spyware (or other)? I haven't written anything to the CD for quite some time. I've done everything else you outlined.

    Greg
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    No, I don`t think that`s caused by malware.

    Try this.

    1. Open My Computer
    2. Right click on the CD-ROM drive and click properties.
    3. Click the "Recording" tab.
    4. Uncheck the "Enable CD Recording on this drive" and close out of all the Windows.

    Does that help?

    If not, try uninstalling and reinstalling your burning software.

    I also forgot to tell you earlier that your Java is seriously out of date.


    Go HERE, download and install the latest version of Java.

    Once it`s installed, go to add remove programmes in your control panel and uninstall all previous versions of Java, except version 6 update 3. Close Control panel.

    Regards Howard :)

    This thread is for the use of gak27 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...