Resolved System Check virus

[Bobbye]

You should never do a System Restore during cleaning unless you are instructed to. Doing restore invalidates all of the previous information.

Please use the Edit feature to add a sentence or a few words. And you don't have to out each log in a separate post. I got an email for each of these replies.

You now have processes for all these antivirus programs:

1/17 has AV: avast! Internet Security
C:\Program Files (x86)\Norton 360\Norton 360\Engine\5.0.0.125\ccSvcHst.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
2011-12-25 22:26:02 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2011-12-25 01:34:11 -------- d-----w- C:\Program Files\Symantec
2011-12-25 01:33:07 -------- d-----w- C:\Program Files (x86)\Norton 360
2011-12-25 01:30:24 -------- d-----w- C:\Program Files (x86)\NortonInstaller

ONE antivirus!
====================================
It appears that Combofix did run before because it quarantined some files.

The problem you're having with Startup is because of this:

If you are infected with System Check it is important that you do not delete any files from your Temp folder or use any temp file cleaners

When you did the System Restore, some files were removed. You did a good job of undoing what we had already done!

You seem to have a history of restores:
RP150: 12/24/2011 6:02:32 PM - Restore Operation
RP151: 12/25/2011 3:30:52 PM - avast! Internet Security Setup> why did you add this on the same day you put Norton on the system??!
RP154: 1/14/2012 8:11:03 PM - Restore Operation

System restore is a valuable tool to have. However, doing a restore is not always a right thing to do.
.

 

[carola89]

i'm sorry, windows wouldn't start and the only option it gave me was to do the restore to fix it.
i just run malwarebytes and this is the log:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.22.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
carola :: CAROLA-HP [administrator]

1/21/2012 6:59:40 PM
mbam-log-2012-01-21 (18-59-40).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 390180
Time elapsed: 1 hour(s), 41 minute(s), 47 second(s)

Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 2152 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

(end)

how can i fix my startup now?

 

[Bobbye]

And you restored back to the malware!!

7. Some items may not show on the Start menu. To add them back:

* Right click on Start> Properties
* Taskbar and Start Menu Properties screen appears
* choose Start Menu tab> Click on Customize
* For Windows XP> Choose Advanced tab
* Check the items you want back on the Start Menu
* When finished> click on OK> Apply and close.

If this doesn't work, you will have to search your system for each program, do a right click> Send to> Desktop to create a shortcut.