Combofix & ESET Results
I tried Combofix and it got hung up after completing step 4. I let it go for hours (actually overnight), but the cursor remained blinking after stating that it completed Step 4.
I finally closed it this morning. When I downloaded it, a warning message popped up at the bottom of my screen stating it was a potentially harmful program, and gave me 2 options - delete the program, or allow it to remain, but don't allow it to launch. I chose the latter, and it appeared to download to the desktop just fine.
I also disabled Northon 360 Antivirus Auto Protect and Malwarebytes protection settings via right-clicking on the systray icons for both. However, when I launched Combofix, it stated that Norton 360 scanning options were still enabled. So, I went into Norton 360 and turned off a couple additional scanning settings. I also tried to exit out of the Combofix pop-up message, thinking it might halt Combofix, but Combofix proceeded and I didn't want to stop it.
End result = Combofix continued running, but never completed after running for hours.
After ending Combofix this morning, I did run ESET. Here's the results of the ESET text file:
C:\Users\Ryan\AppData\Local\Temp\Av-test.txt Eicar test file
2 other pieces of relevant information....
I CAN boot up to the regular Windows (not just Safe mode). You had asked about that. When I did the original "restore to factory settings" in recovery mode, the system booted up fine and seemed fine (other than Malwarebytes detecting the problems). If I hadn't installed Malwarebytes pro and enabled protect mode, I likely wouldn't have found anything wrong. Fyi, Malwarebytes continues to periodically block outgoing traffic to the 2 IP addresses I posted to you earlier.
Also, Windows update downloaded updates and forced a restart on me yesterday (prior to me doing anything with Combofix & ESET). One of the items it installed was "Windows Malicious Software Removal Tool - KB890830". After rebooting, that tool launched automatically and popped up a results box that stated it detected "Trojan
OS/Alureon.A" and said it partially removed it, followed by this recommendation. Fyi, I didn't perform any of these steps - will wait for your advice.:
This virus may cause damage to the Master Boot Record (MBR) and Boot Configuration Data (BCD). You will need to run the following commands using the "bootrec.exe" tool to ensure a complete repair of your computer:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd
For more details on these commands, please refer to Microsoft Security Article KB927392, with specific focus to the options "/fixmbr", "/fixboot" and "/rebuildbcd".
