[kydd]

Can anyone tell me why this computer is running crazy slow? is it maybe because of these two
FREEzeFrog.exe & zeabei.exe??

The web browser freezes up every 15-20 minutes.
CPU usage is always at %100
i don't know when this problem occurred or how it did.

i ran a quick scan with mbam and otl and have the log

Attached Files

•  mbam-log-2011-08-06 (16-22-30).txt   7.59KB   135 downloads
•  OTL.Txt   73.01KB   133 downloads
•  Extras.Txt   31.93KB   110 downloads

Edited by kydd, 06 August 2011 - 06:37 PM.

[Advertisements]

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________



Remove Program
We need to remove a program. To do this please do the following:

• Click Start
• Go to Control Panel
• Go to Add/Remove Programs
• Find and click Remove for the following (if present):
  
• FREEzeFrog
• Hot_MP3 Toolbar
• OddsMaker Toolbar <== If you don't use it, then I suggest removing it.

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Processes
  KILLALLPROCESSES
  :OTL
  SRV - (wscsvc) --  File not found
  SRV - (LPDSVC) --  File not found
  SRV - (HidServ) --  File not found
  SRV - (ERSvc) --  File not found
  SRV - (ekrn) --  File not found
  SRV - (EhttpSrv) --  File not found
  SRV - (ClipSrv) --  File not found
  SRV - (CiSvc) --  File not found
  SRV - (.EsetTrialReset) -- C:\WINDOWS\System32\regedt32.exe (Microsoft Corporation)
  DRV - (epfwtdir) -- C:\WINDOWS\system32\drivers\epfwtdir.sys (ESET)
  DRV - (ehdrv) -- C:\WINDOWS\system32\drivers\ehdrv.sys (ESET)
  DRV - (eamon) -- C:\WINDOWS\system32\drivers\eamon.sys (ESET)
  [2010/04/24 19:01:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
  O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No CLSID value found.
  O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - No CLSID value found.
  O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
  O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No CLSID value found.
  O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found.
  O2 - BHO: (no name) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{53707962-6F74-2D53-2644-206D7942484F} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{bf00e119-21a3-4fd1-b178-3b8537e75c92} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {719D74AB-1AF9-43A1-8C62-D8750628D93E} - No CLSID value found.
  O4 - HKLM..\Run: []  File not found
  O4 - HKLM..\Run: [FREEzeFrogSA] C:\Program Files\FREEzeFrog\bin\1.0.670.0\FREEzeFrogSA.exe ()
  O4 - HKLM..\Run: [TaskTray]  File not found
  O4 - HKCU..\Run: [zeabei] C:\Documents and Settings\Administrator\zeabei.exe ()
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
  O33 - MountPoints2\{3fce7c58-46bd-11e0-92af-001150d47379}\Shell - "" = AutoRun
  O33 - MountPoints2\{3fce7c58-46bd-11e0-92af-001150d47379}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{3fce7c58-46bd-11e0-92af-001150d47379}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ZEAbEi.EXe
  O33 - MountPoints2\{cf042d2a-367c-11df-ad9a-001150d47379}\Shell - "" = AutoRun
  O33 - MountPoints2\{cf042d2a-367c-11df-ad9a-001150d47379}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{cf042d2a-367c-11df-ad9a-001150d47379}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL lVQiOx.ExE
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FREEzeFrogSA
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Program Files\FREEzeFrog
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\FREEzeFrog
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
  [2010/06/22 12:11:11 | 000,057,344 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\chrtmp
  [2010/03/22 23:01:01 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Bboladerirife.dat
  [2010/03/22 23:01:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Kdudanileriheha.bin
  [2011/05/04 21:42:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Administrator\Application Data\.#
  [2011/07/17 04:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\FREEzeFrog
  [2011/07/17 04:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
  [2010/04/30 04:44:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
  [2010/05/30 12:08:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
  [2011/08/06 04:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FREEzeFrogSA
  @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89C6F032
  @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CECC239D
  
  :Reg
  
  :Files
  C:\WINDOWS\System32\regedt32.exe 
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

• IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  
  Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
  
• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

[SweetTech]

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________



Remove Program
We need to remove a program. To do this please do the following:

• Click Start
• Go to Control Panel
• Go to Add/Remove Programs
• Find and click Remove for the following (if present):
  
• FREEzeFrog
• Hot_MP3 Toolbar
• OddsMaker Toolbar <== If you don't use it, then I suggest removing it.

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Processes
  KILLALLPROCESSES
  :OTL
  SRV - (wscsvc) --  File not found
  SRV - (LPDSVC) --  File not found
  SRV - (HidServ) --  File not found
  SRV - (ERSvc) --  File not found
  SRV - (ekrn) --  File not found
  SRV - (EhttpSrv) --  File not found
  SRV - (ClipSrv) --  File not found
  SRV - (CiSvc) --  File not found
  SRV - (.EsetTrialReset) -- C:\WINDOWS\System32\regedt32.exe (Microsoft Corporation)
  DRV - (epfwtdir) -- C:\WINDOWS\system32\drivers\epfwtdir.sys (ESET)
  DRV - (ehdrv) -- C:\WINDOWS\system32\drivers\ehdrv.sys (ESET)
  DRV - (eamon) -- C:\WINDOWS\system32\drivers\eamon.sys (ESET)
  [2010/04/24 19:01:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
  O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No CLSID value found.
  O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - No CLSID value found.
  O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
  O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No CLSID value found.
  O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found.
  O2 - BHO: (no name) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{53707962-6F74-2D53-2644-206D7942484F} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{9384bd4c-dd14-4be9-80f7-f6277511e4f5} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{bf00e119-21a3-4fd1-b178-3b8537e75c92} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
  O2 - BHO: (no name) - Disabled:{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {719D74AB-1AF9-43A1-8C62-D8750628D93E} - No CLSID value found.
  O4 - HKLM..\Run: []  File not found
  O4 - HKLM..\Run: [FREEzeFrogSA] C:\Program Files\FREEzeFrog\bin\1.0.670.0\FREEzeFrogSA.exe ()
  O4 - HKLM..\Run: [TaskTray]  File not found
  O4 - HKCU..\Run: [zeabei] C:\Documents and Settings\Administrator\zeabei.exe ()
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
  O33 - MountPoints2\{3fce7c58-46bd-11e0-92af-001150d47379}\Shell - "" = AutoRun
  O33 - MountPoints2\{3fce7c58-46bd-11e0-92af-001150d47379}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{3fce7c58-46bd-11e0-92af-001150d47379}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ZEAbEi.EXe
  O33 - MountPoints2\{cf042d2a-367c-11df-ad9a-001150d47379}\Shell - "" = AutoRun
  O33 - MountPoints2\{cf042d2a-367c-11df-ad9a-001150d47379}\Shell\AutoRun - "" = Auto&Play
  O33 - MountPoints2\{cf042d2a-367c-11df-ad9a-001150d47379}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL lVQiOx.ExE
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\FREEzeFrogSA
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Program Files\FREEzeFrog
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\FREEzeFrog
  [2011/07/17 04:07:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
  [2010/06/22 12:11:11 | 000,057,344 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\chrtmp
  [2010/03/22 23:01:01 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Bboladerirife.dat
  [2010/03/22 23:01:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Kdudanileriheha.bin
  [2011/05/04 21:42:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Administrator\Application Data\.#
  [2011/07/17 04:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\FREEzeFrog
  [2011/07/17 04:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
  [2010/04/30 04:44:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
  [2010/05/30 12:08:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
  [2011/08/06 04:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FREEzeFrogSA
  @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:89C6F032
  @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CECC239D
  
  :Reg
  
  :Files
  C:\WINDOWS\System32\regedt32.exe 
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

• IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  
  Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
  
• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

[SweetTech]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.