[Essexboy]

From the other computer download this programme and copy across to the infected system

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[Advertisements]

I copied combofix to my flash drive and installed it on to my computers desktop. when attempting to run it I get the message combofix.exe is infected

[duke0466]

I copied combofix to my flash drive and installed it on to my computers desktop. when attempting to run it I get the message combofix.exe is infected

[Essexboy]

Could you run another OTS scan for me please

[duke0466]

OTS has disappeared from my desktop. I will attempt to put it on my flashdrive and replace it.

[duke0466]

I have OTS back on my desktop, but it will not stay open. I double click it and the dialog box opens but justy for a brief moment and it closes. Again it says OTS.exe infected. This is trying my patience, I'm afraid I may smash this machine with a large rock !!

[Essexboy]

OK lets stop messing around and kill it from outside of windows

OK this file is big about 276.7Mb, print these instruction out so that you know what you are doing

File details
Bytes - 290,236,416
MB - 276.7
MD5 - 910CBB8EA943B17ABCEDD09610664342

Two programmes to download

First

ISOBurner this will allow you to burn OTLPE.iso to a CD and make it bootable. Just install the programme, from there on in it is fairly automatic. Instructions

Second

• Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 276.7Mb in size so it may take some time to download.
• When downloaded double click and this will then open ISOBurner to burn the file to CD
• Reboot your system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
  
  
• Your system should now display a Reatogo desktop.
  Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
  
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your reply.

[duke0466]

unfortunately, the wifes computer is just a netbook with no CD drive. I copied your fix into a word doc and placed it my my flashdrive as I have gotten OTS to open again. Unfortunately, I cannot get the word document to stay open long enough to place your fix into notepad and copy into OTS fix

[Essexboy]

Download the attached fix.txt and then just drag and drop it onto OTS where it says "Paste fix here" and then click the Run Fix button.

[duke0466]

Okay, I got you fix into OTS and ran it. I'm currently rebooting and we'll see where we're at. Got a notepad message that reads:
Process fcvlsftav.exe killed successfully

Edited by duke0466, 20 February 2010 - 02:47 PM.

[Essexboy]

That was the main one - how goes it now ?

[duke0466]

yes, there were many others in the notepad message. alot of "successfully". I'm booting up right now to see where we are at. Malwarebytes is running.

[Essexboy]

Malwarebytes is running. - may have broken the back of it

[duke0466]

I could not update malware. I have no internet connection. could be my wireless got disabled? So far it's found 8 infected files

Edited by duke0466, 20 February 2010 - 02:57 PM.

[Essexboy]

Yep we will check that next - for now run malwarebytes and then another full scan for OTS and post both logs

[duke0466]

how will I post logs from that machine with this machine without internet connection?