I appreciate your efforts...Lets try what we can. Maybe someone can give us something new to try that may help us...the computer seems to be working, just know there is still something out there waiting to pray on the system...

Thank you, standing-by.

Delete current copy of ComboFix, redownload a fresh one, post the log here.

Thanks kritius.

Dad, do a right click> Delete on the Conbofix report on the desktop, then rerun the program.

You are in good hands.

Thank you for reviewing the situation.

Deleted, re-installed, re-ran...log attached.

Attached Files

log.txt (20.2 KB, 6 views)

Dad, I'll wait for kritius to review the Combofix log, but I noticed this recent activity. It would be a good idea if you did not install any programs while cleaning. Each has a potential for bringing in new malware, especially gaming sites..

2007-08-30 01:31 -------- d-----w- c:\program files\Full Tilt Poker.Net

2009-11-18 02:35 -------- d-----w- c:\documents and settings\Joseph\Local Settings\Application Data\FullTiltPoker
2009-11-20 06:33 -------- d-----w- c:\program files\Full Tilt Poker
2009-11-18 01:01 31501742 ----a-w- C:\FullTiltSetup.exe

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.


Post a fresh HijackThis log as well.

The computer had been running well, although it had the continuing problem recognized by Kaspersky....It had a version of Fulltilt on the computer that required an update...It worked fine and all was well. I deleted and then downloaded combofix as reccomended. It ran fine and I posted the log output file. Shut off the computer and that was it for the day.....I tried to log in today, and it came up to the blue screen with text saying that I may have a virus or if I recently installed a new hard drive to check the connections...I tried to log in safe mode and it gave me the same screen and text...I even tried to log in last known good configuration and it gave me the same screen and text....what can I do?

Without able to boot up the computer...I cant download any new programs..I am responding from a separate laptop. The computer in question, I cant boot up in safe mode or regular mode....HELP!! I dont know if my son has a Windows boot disc around?? I can get a command prompt from one of the options when hitting ctrl 8 and choosing one of the options other than Safe mode/networking or ?? What else can I do to get back into the computer?? There are many files that need to be retrieved still that are on this computer.

So you didn't get a chance to run the CFScript?

Can you enter the recovery console at boot?

If so,

type the following at the Recovery console command prompt,

cd erdnt\subs

At the next prompt, type the following bolded text, and press Enter:

batch erdnt.con

The erunt backups will begin copying.

At the next prompt, type the following bolded text, and press Enter:

exit

Windows will now begin loading.

Mercifies, we have already established that being unable to boot into windows makes it hard to download inferior cleaning tools such as spyware doctor.

Stop posting Mercifies, lets try not to have lots of suggestions flying in thick and fast.

I am in the Windows Advanced Options Menu....cant do safe mode or safe mode with netowrking....when I go to Safe mode with command prompt I have a choice of Windows Recovery Console or Microsoft Windows XP Home Edition. When I go to recovery Console,,,there is a prompt but I cant type anything from the keyboard..when I go to MW XP Home edition I get the blue screen where it states A problem has been detected and windows has been shut down to prevent damage to your computer...If this is the first time youve seen this Stop error screen, restart your computer....check for viruses on your computer...and so on...
technical information STOP 0x0000007B (0xF7B7C640, OxC0000034, 0x00000000)

You cannot type anything in the recovery console? Is this a laptop or a desktop?

This is a Dell Dimension Desktop

This looks to be a problem with the keyboard being recognised, quite annoying.

It wouldn't happen to b a multi media usb keyboard?

Its not a multi media keyboard...

when I try to get into recovery console, I dont get the screen i remember in the past...its just a flashing " -" at the top of the screen. When I try and type a bunch of characters, nothing comes up and I get a beep from the box....

can I do anything from the boot device menu......gives me System Setup as an option??

I dont think I have a windows boot disc for this box?? Can I create one from another computer?? I need to retrieve more of my sons files from this box for him....

As a last resort, can I remove the hard drive and make it a slave in another desktop and carefully remove the files needed?? Will this hard disc drive be able to be recognized by another computer and possibly different operating system??

In theory it should be able to be recognised as a slave. Another option would be to go in with a linux live disc and retrieve the files.

The Linux Live CD would be the least risk route. Although you've gone through a cleaning,
this would remove uncertainties in regards to boot_sector code and autoruns.

I am at a different point for my computer's trojan/worm, so I am considering a Rescue CD with AV scanners.

Here is a link describing a lot of work to make a bootable Recovery Console on CD. However, their purist approach causes me to doubt that this will work, since my brand of oem_xp seems to omit files from the i386 folder. This could be a blessing in disguise -- I used a full version XP installation CD to load the recovery console on the computer with oem_xp.