Can't completely clean my system - logs attached

[gak27]

Greetings all!

As requested, I have followed all the instructions and attached the following logs:

- HJT
- Combofix
- AVG Antispyware

The Panda Antirootkit scan found no unknown rootkits.

Symptoms: When computer boots up (either in safe mode or normal) I get a message at the bottom right tray saying that I have files waiting to write to the CD, and to please click the balloon to see these files. After the system boots up, I get IE windows randomly popping up with nasty links. For awhile I was also having problems with the "Security Toolbar 7.1" issue but I seem to have solved this with a system restore action. The symptoms I described above are still happening. Any help will be most welcomed. Thank you for this site.

Greg

 

[howard_hopkinso]

Hello and welcome to Techspot.

Delete all files in AVG Antispyware quarantine.

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\WINDOWS\system32\jrgyvrey.dll
C:\WINDOWS\system32\fnxfakmd.dll
C:\WINDOWS\system32\d3d8caps.dat
C:\WINDOWS\system32\jbowmxef.dll
C:\WINDOWS\system32\vturpmk.dll
C:\WINDOWS\system32\ljjjjji.dll.vir
C:\WINDOWS\system32\ddabc.dll
C:\WINDOWS\system32\pmnnk.dll

Folder::
C:\VundoFix Backups
C:\Program Files\Viewpoint
C:\WINDOWS\system32\Mz02r
C:\Temp\mZOr

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0ac0f2c7-f91c-4eae-ba24-fe8d0df32277}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5DC3BC2-8806-4F3B-A53E-C0F3A48A506B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"b802ddc6"=-

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

Please open notepad and and copy and paste next bold in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"="msv1_0"

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.

Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Regards Howard :wave: :wave:

This thread is for the use of gak27 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[gak27]

Howard,

I just finished all of the steps you outlined above. I have attached the new HJT and Combofix logs. These were generated prior to running the fix.reg step (according to the order you outlined). Am I in better shape? Any other steps I need to take (I know you still need to look at the logs). I noticed that the "files waiting to be written to CD" balloon did not pop up on rebooting...do you know what I might have been infected with?

Sincerely,

Greg

Edit: After rebooting the machine, the "CD" balloon reappeared...

 

[howard_hopkinso]

All clean.

Delete the following folder.

C:\qoobox

Your system was infected with a variety of malware, including the vundo trojan.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of gak27 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[gak27]

Howard,

When I reboot the machine, I still get the "Files are waiting to be written to the CD. Click this balloon to see the files" balloon, along with a CD drive icon.
Is this due to malware/spyware (or other)? I haven't written anything to the CD for quite some time. I've done everything else you outlined.

Greg

 

[howard_hopkinso]

No, I don`t think that`s caused by malware.

Try this.

1. Open My Computer
2. Right click on the CD-ROM drive and click properties.
3. Click the "Recording" tab.
4. Uncheck the "Enable CD Recording on this drive" and close out of all the Windows.

Does that help?

If not, try uninstalling and reinstalling your burning software.

I also forgot to tell you earlier that your Java is seriously out of date.


Go HERE, download and install the latest version of Java.

Once it`s installed, go to add remove programmes in your control panel and uninstall all previous versions of Java, except version 6 update 3. Close Control panel.

Regards Howard

This thread is for the use of gak27 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.