I have no idea how to reformat... I used an HP program in the past but after the last unsuccessful reformat my friend loaded my comp up w/o any of those programs. So plz tell me how to do this! I want everybody completely gone, except the bare essentials.

Hi,

You can check out our tutorial thread on How to reformat your hard drive and install/reinstall Windows.

Hope this helps.


Regards,
Your friendly Momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

I have finished reformatting and have ran combofix and hijackthis so far. I have just finished downloading AVG AntiSpyware but I figured that I should just show you my combofix and Hijack This! while AVG finishes scanning.

I get frequent popups that read... "Message from FROM to TO on 5/28/2007 9:45:22 PM
STOP! WINDOWS REQUIRES IMMEDIATE ATTENTION.
Windows has found 55 Critical System Errors.
To fix the errors please do the following:

1. Download Registry Update from: www.regfixit.com
2. Install Registry Update
3. Run Registry Update
4. Reboot your computer

FAILURE TO ACT NOW MAY LEAD TO SYSTEM FAILURE!"

Hi,

Please follow these instructions carefully.

1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt (from my attachment) and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh ComboFix and AVG Antispyware log.


Regards,
Your friendly momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Here are the updated logs.

Hi,

Please reboot into safe mode and unhide your files and folders like previously.

Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

ezcu.exe

Navigate in Windows Explorer and delete the following files and folders in bold.

C:\WINDOWS\system32\ezcu.exe
C:\WINDOWS\system32\nyqcccf.bat

Reboot into normal mode and rehide your protected OS files.

Thereafter, please post fresh HJT and ComboFix logs from normal mode as attachments into this thread.


Regards,
Your friendly momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

I just reformatted again and here are my updated AVG, Combofix and HJT logs.

Hi,

The reason why your system is getting infected so easily and quickly even after a reformat is because you are not running a firewall.

Here are some recommended software and links to them.

For antivirus, please use one and only one. Using more than one is not recommended as it may cause serious conflicts in your system.
AVG freeAvast

For firewalls please use one and only one. Using more than one is not recommended as it will hog your system resources.
Zonealarm
Kerio
Comodo

Here are some other miscelleneous programs which I recommend.
Spybot Search & Destroy. < use this if you have no other real time monitoring programs such as spyware doctor.
Ccleaner.

Whenever you do a reformat, the first thing after installing windows should be getting these programs as your first line of defence. Then go ahead and download your other software like WoW and BitComet.

That said, have HijackThis fix this entry:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Navigate in Windows Explorer and delete this file:

C:\WINDOWS\ALCXMNTR.EXE

Go to Start > Run. Type regedit and press enter.
Press ctrl + f and find all instances of ALCXMNTR.EXE and delete them.

Apart from that, your logs are clean.

Delete all files in AVG Antispyware Quarantine folder.

Turn off system restore (XP/ME only). Learn how to do that HERE.
This will remove all the remaining nasties from your old restore points.

After that turn system restore back on.
This would have created a new safe and clean restore point for your system.

Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
May I recommend you to read this article.
This can help to prevent future infections.

Should you have any further problems, please post in this thread.


Regards,
Your friendly momok =)

This thread is for the use of sublime487 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.